0

I am struggelling with the file recovery of an internal storage of an android phone.

I made a dd copy of the /dev/sda device which includes the system and userdata and some other partitions of the phone.

bla@bla:/media/Volume$ mmls sda.raw 
GUID Partition Table (EFI)
Offset Sector: 0
Units are in 4096-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Safety Table
001:  -------   0000000000   0000000005   0000000006   Unallocated
002:  Meta      0000000001   0000000001   0000000001   GPT Header
003:  Meta      0000000002   0000000002   0000000001   Partition Table
004:  000       0000000006   0000000015   0000000010   padding0
005:  001       0000000016   0000016399   0000016384   recovery
006:  002       0000016400   0000032783   0000016384   boot
007:  003       0000032784   0001011727   0000978944   system
008:  004       0001011728   0001026063   0000014336   apppreload
009:  005       0001026064   0001041423   0000015360   cota
010:  006       0001041424   0015447055   0014405632   userdata
011:  007       0015447056   0015450106   0000003051   reserve0
012:  -------   0015450107   0015450111   0000000005   Unallocated

I am able to mount some partitions:

bla@bla:/media/Volume$ sudo fsstat -b 4096 -o 32784 sda.raw 
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: Ext4
Volume Name: system
Volume ID: 7019a2b4b48a33b92c4409cbe0a229c7

Last Written at: 2020-05-28 21:04:07 (CEST)
Last Checked at: 2019-07-22 16:11:16 (CEST)

Last Mounted at: 2020-05-28 20:55:42 (CEST)
Unmounted properly
Last mounted on: /system

Source OS: Linux
Dynamic Structure
Compat Features: Journal, Ext Attributes, Resize Inode, Dir Index
InCompat Features: Filetype, Extents, Flexible Block Groups, 
Read Only Compat Features: Sparse Super, Large File, Huge File, Extra Inode Size

Journal ID: 00
Journal Inode: 8

METADATA INFORMATION ...

But not the userdata partition. Are there any tricks I missed so far?

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk sda.raw - 63 GB / 58 GiB - CHS 7694 255 63
     Partition               Start        End    Size in sectors
>P MS Data                   262272    7971615    7709344 [system]
 P MS Data                  8093824    8208511     114688
 D MS Data                  8208512    8331391     122880
 D MS Data                  8331390  123576413  115245024

Outputs for userdata:

bla@bla:/media/Volume$ sudo fsstat -b 4096 -o 1041424 sda.raw
Cannot determine file system type

Thanks for any hints in advance!

Klaus

Improve this question
4
  • 1
    Android version? How file was deleted? May be userdata is encrypted? Why did you dump the whole flash storage and not only the userdata partition?
    – Irfan Latif
    May 28, 2020 at 21:17
  • 1
    The most likely reason is the partition was encrypted. So without the encryption key (stored on-device) there's no chance to decrypt and thus no chance to mount. Read the answer on How does Marshmallow encryption work technically – and you will find the encryption key is stored in a way that makes retrieval close to impossible. If the device is still accessible, you might have a chance via TWRP custom recovery, if it still can decrypt userdata, to then tar the contents and investigate the tarball.
    – Izzy ♦
    May 28, 2020 at 22:08
  • 1
    Android version is 9.+ The linked page dosen't tell me new things, I already read the articles but thx a lot! I did a full backup, because the userdata partition alone didn't worked. - Maybe because of the encryption. @Izzy I'll try it and let you know if I could restore something.
    – Klaus
    May 29, 2020 at 18:34
  • we recently discussed that it is impossible to recover a deleted file from FBE chat.stackexchange.com/transcript/108420
    – alecxs
    May 30, 2020 at 2:01

0

Reset to default

Browse other questions tagged .