1

Yesterday, I suddenly discovered that I had lost all the user files on the internal memory of my android phone. All my photos, my music, my PDFs, audio recordings, everything. I will explain the events leading up to this in a separate paragraph below.

I have a Lava Z90 phone and I do not use an external SD card, so I must work with my phone to recover all data. I've been googling and following stuff I get from the internet(including Stack Overflow). Here's what I have done so far.

  1. Tried using photo recovery apps available on Play Store. None of them worked.

  2. Decided to go more technical. Enabled USB Debugging and OEM Unlocking from Developer options in my phone. Then I used ADB pull command, pull /dev/block/mmcblk0 /home/data.img to try create an image of the entire internal storage so I can analyse it using PhotoRec. It says pull: not found

  3. I assumed this is because my phone isn't rooted? I tried to root it with the KingoRoot apk but that didn't work. I have Ubuntu on my PC and there is not KingoRoot for Ubuntu. My next step would be to use Wine to run KingoRoot on my machine and try to root my phone that way.

I have the following questions:

  • How can I create an image, a data dump of my entire internal storage that i can later analyse for my data?

  • Can I do it with an unrooted phone? If not, how can I root my phone with ADB?

  • Am I going about this right? Is there a better, easier way to recover data that I should use instead?

Thank you very much.

How I lost my data

I recently uninstalled the TikTok app from my phone. Yesterday I connected my phone to my PC over mtp and found that there were certain leftover folders on the internal memory. One was a folder with Chinese name, one was a folder called ByteDance and one folder called Thumbnails. I assumed that the first two were leftovers from the TikTok app and the third was mere thumbnails. So I deleted them to save space. Nothing happened that day, except that I couldn't access any of my WhatsApp images through WhatsApp(they were still accessible through the gallery). However, when I woke up the next morning, all my data on the internal memory was gone. I still have contacts my messages and my settings, just that everything that was accessible through the file explorer has disappeared.

  • Does the free space indicate that all files are deleted (just to make sure)? // pull isn't a command, you need to do adb pull. // Rooting with apps doesn't always work, neither it's a recommended method. See this: android.stackexchange.com/a/205707/218526 // All of your three questions are answered in the linked question. – Irfan Latif Dec 12 '19 at 9:28
  • 1
    Does this answer your question? How to recover a deleted file from /data partition? – Irfan Latif Dec 12 '19 at 9:29
  • Irfan Latif, there is free space shown in the file manager. I think that means they were deleted. I am running the pull command inside the shell, which I first type adb shell, and then run all subsequent commands inside of that. – Nostromo Dec 12 '19 at 11:10
  • pull is implemented inside adb, not a separate binary. See usage in linked answer. – Irfan Latif Dec 12 '19 at 11:16
  • Alright, I fiddled around and ran adb pull /dev/block/mmcblk0 /home mmc.img instead. It says, remote object '/dev/block/mmcblk0' does not exist. I either need to figure out where the phone is mounted or a way to mount this mtp device as a normal drive so regular backup applications can take care of it. – Nostromo Dec 12 '19 at 12:17
1

for Mediatek devices do following:

if your device is encrypted

  • get a temp root shell with mtk-su
  • dump your decrypted userdata partition /dev/block/dm-0
    (this will take ~25 GB/h)

    sudo apt-get install android-tools-adb extundelete testdisk
    adb push mtk-su /data/local/tmp/
    adb shell chmod 0755 /data/local/tmp/mtk-su
    adb shell /data/local/tmp/mtk-su -c "cat /dev/block/dm-0 2> /dev/null" > userdata.img
    

if your device is not encrypted

  • switch off device, remove battery (if possible)
  • install VCOM preloader drivers (Windows)
  • find a scatter file for your ROM
  • download SP Flash Tool (Windows)
  • do a read back of userdata partition (SP Flash Tool)

once you have a ext4 disk image of userdata:

  • open userdata.img with testdisk (linux)
  • copy deleted files, or
  • scan the whole userdata.img with extundelete (linux)

    testdisk userdata.img
    

    [Proceed ]
    [None ] Non partitioned media
    [ Advanced ] Filesystem Utils
    (press Enter 3x times)
    [ List ] List and copy files
    (deleted files are colored red)
    a to select all files
    Shift + C to copy the selected files
    (select destination folder)
    C when the destination is correct

    testdisk

    extundelete userdata.img --restore-all
    

    (check folder ~/RECOVERED_FILES/media/0/)

  • if you don't have scatter file create your own forum.hovatek.com/thread-21970.html – alecxs Dec 12 '19 at 23:13
  • turns out adb exec-out for linux only works with busybox dd and dos2unix while adb shell works for linux only. no success for windows, yet. funny thing is cat and dd produces different output for built-in (toybox/toolbox) and busybox variant pastebin.com/Z5ptLhqM – alecxs Dec 14 '19 at 1:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.