0

I am struggelling with the file recovery of an internal storage of an android phone.

I made a dd copy of the /dev/sda device which includes the system and userdata and some other partitions of the phone.

bla@bla:/media/Volume$ mmls sda.raw 
GUID Partition Table (EFI)
Offset Sector: 0
Units are in 4096-byte sectors

      Slot      Start        End          Length       Description
000:  Meta      0000000000   0000000000   0000000001   Safety Table
001:  -------   0000000000   0000000005   0000000006   Unallocated
002:  Meta      0000000001   0000000001   0000000001   GPT Header
003:  Meta      0000000002   0000000002   0000000001   Partition Table
004:  000       0000000006   0000000015   0000000010   padding0
005:  001       0000000016   0000016399   0000016384   recovery
006:  002       0000016400   0000032783   0000016384   boot
007:  003       0000032784   0001011727   0000978944   system
008:  004       0001011728   0001026063   0000014336   apppreload
009:  005       0001026064   0001041423   0000015360   cota
010:  006       0001041424   0015447055   0014405632   userdata
011:  007       0015447056   0015450106   0000003051   reserve0
012:  -------   0015450107   0015450111   0000000005   Unallocated

I am able to mount some partitions:

bla@bla:/media/Volume$ sudo fsstat -b 4096 -o 32784 sda.raw 
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: Ext4
Volume Name: system
Volume ID: 7019a2b4b48a33b92c4409cbe0a229c7

Last Written at: 2020-05-28 21:04:07 (CEST)
Last Checked at: 2019-07-22 16:11:16 (CEST)

Last Mounted at: 2020-05-28 20:55:42 (CEST)
Unmounted properly
Last mounted on: /system

Source OS: Linux
Dynamic Structure
Compat Features: Journal, Ext Attributes, Resize Inode, Dir Index
InCompat Features: Filetype, Extents, Flexible Block Groups, 
Read Only Compat Features: Sparse Super, Large File, Huge File, Extra Inode Size

Journal ID: 00
Journal Inode: 8

METADATA INFORMATION ...

But not the userdata partition. Are there any tricks I missed so far?

TestDisk 7.0, Data Recovery Utility, April 2015
Christophe GRENIER <[email protected]>
http://www.cgsecurity.org

Disk sda.raw - 63 GB / 58 GiB - CHS 7694 255 63
     Partition               Start        End    Size in sectors
>P MS Data                   262272    7971615    7709344 [system]
 P MS Data                  8093824    8208511     114688
 D MS Data                  8208512    8331391     122880
 D MS Data                  8331390  123576413  115245024 

Outputs for userdata:

bla@bla:/media/Volume$ sudo fsstat -b 4096 -o 1041424 sda.raw
Cannot determine file system type

Thanks for any hints in advance!

Klaus

4
  • 1
    Android version? How file was deleted? May be userdata is encrypted? Why did you dump the whole flash storage and not only the userdata partition? Commented May 28, 2020 at 21:17
  • 1
    The most likely reason is the partition was encrypted. So without the encryption key (stored on-device) there's no chance to decrypt and thus no chance to mount. Read the answer on How does Marshmallow encryption work technically – and you will find the encryption key is stored in a way that makes retrieval close to impossible. If the device is still accessible, you might have a chance via TWRP custom recovery, if it still can decrypt userdata, to then tar the contents and investigate the tarball.
    – Izzy
    Commented May 28, 2020 at 22:08
  • 1
    Android version is 9.+ The linked page dosen't tell me new things, I already read the articles but thx a lot! I did a full backup, because the userdata partition alone didn't worked. - Maybe because of the encryption. @Izzy I'll try it and let you know if I could restore something.
    – Klaus
    Commented May 29, 2020 at 18:34
  • we recently discussed that it is impossible to recover a deleted file from FBE chat.stackexchange.com/transcript/108420
    – alecxs
    Commented May 30, 2020 at 2:01

0

Browse other questions tagged .