First to clarify
- Root directory
/ of Android devices is a read-only pseudo (temporary) filesystem (
rootfs) that lives in RAM and is vanished when device is powered off. When device is powered on, it's again extracted from
initramfs that lives in
boot partition along with kernel.
/data directory is a mountpoint, where largest partition, usually named
userdata is mounted. This partition contains all user apps, their data (settings, databases, caches, temporary files etc.), system apps' data and all other configurations we make through
/data/media/0 is the directory that we see as
/storage/emulated/0 through emulation.
... there was a file in the /data directory which I need. Is it possible to create an image (.img or something similar) of the root directory ...
If a file is deleted from
/data, you need to create a dump of
data partition, not that of root directory.
You can do that in two ways. Both require root access.
DISK DUMP (
First of all find the block device for
userdata partition. If you have root access, you can find out the block device from mounted partitions:
~# mount | grep 'on /data'
/dev/block/mmcblk0p... on /data type f2fs (rw,nosuid,nodev,...)
On Qualcomm devices, it's located at
/dev/block/bootdevice/by-name/userdata (symlink). For MediaTek (
MTK) and other SoCs, the path is slightly different. You can find all block devices or
by-name directory using
~# find /dev -type b
~# find /dev -type d -name 'by-name'
Or by hit and trial:
~# ls -d /dev/*/by-name
~# ls -d /dev/*/*/by-name
~# ls -d /dev/*/*/*/by-name
/data partition has Full Disk Encryption (FDE) and you unencrypted it in recovery, DMCrypt will create block device at dev/block/dm-0.
Once the block device is known, you can use
dd command from:
- ADB shell (OS or custom recovery)
- A terminal emulator app like Termux
userdata partition is the largest partition (all other partitions hardly using 5GB out of total storage), you can't dump it to your internal memory. An external SD card with larger capacity is needed.
To create dump:
~# dd if=/dev/block/bootdevice/by-name/userdata of=/path/to/ext_sdcard/data.img
To prevent any data loss, recommended is to create dump when partition is not mounted i.e. in recovery mode.
If you don't want to use external SD card, you can also dump the partition directly to PC:
~$ adb exec-out dd if=/dev/block/bootdevice/by-name/userdata > data.img
* Make sure your
adb binary (on Windows or Linux) supports exec-out.
But you may end up with corrupted data when writing a whole large-sized partition to
STDOUT of terminal because there are issues with line break types (
STDERR could possibly be added to file if not directed to
/dev/null. See this question for reference.
To recover deleted files, you need to access
data.img on Linux because Windows doesn't support
f2fs natively, hence the tools aren't easily available AFAIK. On Linux you can use tools like extundelete and testdisk.
If anyone has been able to successfully make block/journal level access to Linux/Android filesystem for data recovery on Windows through Ext3Fsd or any other driver, let me know so that I can update the answer.
USB MASS STORAGE (UMS)
UMS is disabled by default on newer Android devices and only MTP is enabled. However you can enable that in custom recovery mode:
~# mountpoint /data && umount /data
~# echo '0' >/sys/class/android_usb/android0/enable
~# echo '/dev/block/bootdevice/by-name/userdata' >/sys/class/android_usb/android0/f_mass_storage/lun/file
~# echo 'mass_storage' >/sys/class/android_usb/android0/functions
~# echo '1' >/sys/class/android_usb/android0/enable
* Kernel should be built with
* Paths may vary depending on device
Find block device of
userdata partition as explained under
userdata will appear as a partition on Linux PC just as we connect a USB drive. If
/dev/sda is the hard disk drive, usually
/dev/sdb will be the
userdata partition. You can find that by using
~# blkid | grep userdata
/dev/sdb: PARTLABEL="userdata" PARTUUID="..."
To mount (preferably read-only to avoid overwriting data):
~# mkdir /data
~# mount -o ro /dev/sdb /data
However recovery tools including
extundelete mostly don't need mounting filesystems. You can create a dump:
~# dd if=/dev/sdb of=data.img
~# extundelete --restore-all data.img
Or recover data directly:
~# extundelete --restore-all /dev/sdb
In the same way you can use any other data recovery tool.