0

I factory reset my rooted Android M phone but now I realize that there was a file in the /data directory which I need.

Is it possible to create an image (.img or something similar) of the /data partition so that I could run some recovery software for ext4 on that image? I have a little knowledge about ADB.

2

First to clarify root and data:

  • Root directory / of Android devices is a read-only pseudo (temporary) filesystem (rootfs) that lives in RAM and is vanished when device is powered off. When device is powered on, it's again extracted from initramfs that lives in boot partition along with kernel.
  • /data directory is a mountpoint, where largest partition, usually named userdata is mounted. This partition contains all user apps, their data (settings, databases, caches, temporary files etc.), system apps' data and all other configurations we make through Settings. /data/media/0 is the directory that we see as /sdcard or /storage/emulated/0 through emulation.

... there was a file in the /data directory which I need. Is it possible to create an image (.img or something similar) of the root directory ...

If a file is deleted from /data, you need to create a dump of data partition, not that of root directory.

You can do that in two ways. Both require root access.

DISK DUMP (dd)
First of all find the block device for userdata partition. If you have root access, you can find out the block device from mounted partitions:

~# mount | grep 'on /data'
/dev/block/mmcblk0p... on /data type f2fs (rw,nosuid,nodev,...)

On Qualcomm devices, it's located at /dev/block/bootdevice/by-name/userdata (symlink). For MediaTek (MTK) and other SoCs, the path is slightly different. You can find all block devices or by-name directory using find command:

~# find /dev -type b
~# find /dev -type d -name 'by-name'

Or by hit and trial:

~# ls -d /dev/*/by-name
~# ls -d /dev/*/*/by-name
~# ls -d /dev/*/*/*/by-name

If your /data partition has Full Disk Encryption (FDE) and you unencrypted it in recovery, DMCrypt will create block device at dev/block/dm-0.

Once the block device is known, you can use dd command from:

  • ADB shell (OS or custom recovery)
  • A terminal emulator app like Termux

Since the userdata partition is the largest partition (all other partitions hardly using 5GB out of total storage), you can't dump it to your internal memory. An external SD card with larger capacity is needed.

To create dump:

~# dd if=/dev/block/bootdevice/by-name/userdata of=/path/to/ext_sdcard/data.img

To prevent any data loss, recommended is to create dump when partition is not mounted i.e. in recovery mode.

If you don't want to use external SD card, you can also dump the partition directly to PC:

~$ adb exec-out dd if=/dev/block/bootdevice/by-name/userdata > data.img  

* Make sure your adb binary (on Windows or Linux) supports exec-out.

But you may end up with corrupted data when writing a whole large-sized partition to STDOUT of terminal because there are issues with line break types (CR LF) and STDERR could possibly be added to file if not directed to /dev/null. See this question for reference.

To recover deleted files, you need to access data.img on Linux because Windows doesn't support ext4 or f2fs natively, hence the tools aren't easily available AFAIK. On Linux you can use tools like extundelete and testdisk.

If anyone has been able to successfully make block/journal level access to Linux/Android filesystem for data recovery on Windows through Ext3Fsd or any other driver, let me know so that I can update the answer.

USB MASS STORAGE (UMS)
UMS is disabled by default on newer Android devices and only MTP is enabled. However you can enable that in custom recovery mode:

~# mountpoint /data && umount /data

~# echo '0' >/sys/class/android_usb/android0/enable
~# echo '/dev/block/bootdevice/by-name/userdata' >/sys/class/android_usb/android0/f_mass_storage/lun/file
~# echo 'mass_storage' >/sys/class/android_usb/android0/functions
~# echo '1' >/sys/class/android_usb/android0/enable

* Kernel should be built with CONFIG_USB_F_MASS_STORAGE
* Paths may vary depending on device

Find block device of userdata partition as explained under dd.

Now userdata will appear as a partition on Linux PC just as we connect a USB drive. If /dev/sda is the hard disk drive, usually /dev/sdb will be the userdata partition. You can find that by using blkid command:

~# blkid | grep userdata
/dev/sdb: PARTLABEL="userdata" PARTUUID="..."

To mount (preferably read-only to avoid overwriting data):

~# mkdir /data
~# mount -o ro /dev/sdb /data

However recovery tools including extundelete mostly don't need mounting filesystems. You can create a dump:

~# dd if=/dev/sdb of=data.img
~# extundelete --restore-all data.img

Or recover data directly:

~# extundelete --restore-all /dev/sdb

In the same way you can use any other data recovery tool.

RELATED:

0

Where exactly in DATA ? Is it in the emulated SD Card ?
If it's in the emulated SD Card, you could remove your external SD Card and mount the device under USB Mass Storage mode... You can the use free recovery software like Recuva ccleaner.com/recuva

However if your file is not in the emulated SD Card, you'd need to backup the Data partition as you mentioned.

To do that, you can either use the device itself to run a DD or CAT command to write the data to a .img file on your SD Card..

On Device
Using Terminal Emulator

  • locate your -by-name partition directory

    getprop ro.frp.pst

( This will get the /dev/block/platform/DEVICE/by-name directory for frp - change the name to data )
You can just use /data otherwise.

dd if=/data of=/sdcard/data.img   

If = Input file - Of = Output file

You could also use ADB

Via Computer

  • Install ADB ( not the entire SDK but just ADB )

Using command prompts or power shell

adb shell dd if=/data of=/sdcard/data.img

You may need to locate your correct directory.

Then you can Mount the .img on a PC and do the recovery.. I'm not sure how to mount the .img file if the partition is ext4 so that's as far as this answer goes.

You can alternatively use an App called Disk Digger .. It has the capability to scan the data partition live, .. Root Access is needed

  • if=/data won't work, it's just a mountpoint, not the block device. dd dumps files, not directories. Secondly, USB Mass Storage can also be used to mount or dump complete data partition from custom recovery directly to PC. – Irfan Latif Feb 21 at 12:16
  • I'm sorry, I didn't realize you are using a Custom Recovery... That's extremely simple, just back it up ! .... I know if=/data won't work, that's why I said find the by-name directory. – Zillinium Feb 24 at 22:02
  • I have a perception that nandroid backups (usually created by tarring) contain only files/directories, not the inode level details of block devices that's required to undelete something. – Irfan Latif Feb 25 at 8:39
  • 1
    No don't use TAR, use DD or Cat to create the image. – Zillinium Feb 25 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.