Sdcardfs is a virtual file system in Android or some Linux systems. It is implemented using FUSE.

It is called Android's 'adopted storage', is used in virtual sdcards, or protected partition areas. (For example: /storage/simulated/0)

If you try to dump an sdcard file system (ex: /sdcard) by dd command, It is not dumpable. (It does not have sectors or anything.

So, if I try to dump the parent file system (ex: 'FUSE like vFAT' on EXT4), it is not recoverable by all of commercial file recovery software. Because sdcardfs is a virtual file system using FUSE, it is not stored like a file or agglomerate something(s).

How can I dump and recover an sdcardfs file system?

migrated from security.stackexchange.com Dec 15 '17 at 0:36

This question came from our site for information security professionals.

  • FUSE is not a virtual filesystem. It's a framework that allows developers to write virtual filesystem drivers. On the other hand, sdcardfs is a virtual filesystem. The fact that it's implemented using FUSE is an implementation detail. What you're really asking is how to dump and restore an sdcardfs filesystem, right? – Gilles Dec 16 '17 at 18:23
  • @Gilles yes. I asking about how to recover files in sdcardfs file system when having only dumped file system image(ex: mmcblk0, mmcblk0p12). the data on SdcardFS is not analysable by general FAT or EXT supported file recovery software. – user115930 Dec 19 '17 at 1:56
  • And it is not mountable becuase it it not stored like a file or partition or agglomerate somethings, and SDcardFS do not supported read sector by sector, it can only read and write by file unit. – user115930 Dec 19 '17 at 2:07
  • SdcardFS is not a FUSE, it's an in-kernel solution. – frogatto Jun 3 '18 at 6:34

You can back up any filesystem by backing up individual files, e.g. in a tar archive. Assuming that you have a set of Linux command line utilities (e.g. a full BusyBox installation):

adb shell 'tar -cz /sdcard | uuencode sdcard.tar.gz' >sdcard.tar.gz.uu
uudecode sdcard.tar.gz.uu

The uuencode/uudecode step is necessary because adb corrupts binary files on output (it adds CR before every LF).

You can open the archive in any archive browser (except the one built into Windows, or at least older versions of Windows, because it only supports the zip format).

To restore:

adb shell 'cd /target/directory && tar -xz' <sdcard.tar.gz

I don't know if there's a lower-level tool to dump an sdcardfs filesystem. Since sdcardfs is a view of an underlying filesystem (i.e. a stackable filesystem), rather than a filesystem built on top of a storage device, there's nothing to dump. But the underlying filesystem is built on a storage device; if you dump that, you will get a full backup and you can access the sdcardfs part by using the sdcardfs driver on the backup and mounting it with the same parameters.

FUSE is pretty much irrelevant here. It's an implementation technique, not a description of the filesystem format.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.