A relative of mine accidentally deleted the "DCIM/Camera" folder with all her photos, and asked me if it's possible to recover them.
I copied the 'userdata' partition (ext4) to a VHD image at once and tried to recover the files (Recuva, R-Studio, Photorec, DiskDrill, DiskDigger, DiskGenius, etc., were used but to no avail). Nearly all the photos were of 0 bytes in size, like they were securely deleted.
Several years ago I encountered a similar issue (the photos just vanished, I believe it was some SD card issue) and recovered files were 0 bytes in size too.
Is there any way to recover the files?
Unfortunately, sync with Google Photos cloud was not set up as well.
Edit: this is how I pulled the image:
Installed BusyBox in the phone;
Installed Filezilla Server on desktop. Settings: listen on those ports: 40, all timeout settings: 0, create new user ("user", "pass") and give him rights for the chosen shared folder ("read write delete" for files and "list + subdirs" for folders);
Disabled Windows firewall;
Checked adb (
Enabled USB tethering, got the new desktop IP via ipconfig (192.168.42.79);
Found the userdata partition (mmcblk0p17):
adb shell cat /proc/emmc | grep userdata
Pulled the dump:
adb shell su mkfifo /cache/myfifo ftpput -v -u user -p pass -P 40 192.168.42.79 mmcblk0p17.raw /cache/myfifo
adb shell su dd if=/dev/block/mmcblk0p17 of=/cache/myfifo
- Voila! We've got a 27 GB mmcblk0p17.raw image.