I have a Moto G5 (XT1676), which is stuck in a boot loop. It will ask for my pattern to unlock the partition, and then the motorola / lenovo logo spins forever and the phone will not boot.

What are my options to recover the user data ?

I am able to access the recovery, and I have tried already tried to clear the cache partition, with no luck. There is no option to backup the user partition in the stock recovery.

I could flash TWRP recovery and backup the phone from here, but my booloader is OEM locked, and unlocking it requires wiping the phone.

Is there a way to unlock the bootloader without wiping the phone ?
Or is there a way to backup the user partition from the stock recovery ?


I was able to make my phone boot again by flashing a stock (official) firmware, without erasing the userdata partition. As it uses an official firmware, this approach does not require unlocking the bootloader. Here is a summary of the steps I followed.

Install fastboot

Fastboot is an utility that is used to upload and flash ROMs on Android Smartphones.
On Linux, fastboot can be downloaded as follows:

wget https://dl.google.com/android/repository/platform-tools-latest-linux.zip
unzip platform-tools_r31.0.0-linux.zip
# Using fastboot requires root permissions, so from now on
# we execute commands as root
sudo -s
export $PATH=$PATH:/path/to/platfrom-tools

For other OSes, you may find installation instructions here:

Start the Moto G5 bootloader

To do so, shutdown you phone. Then press Volume down and Power
Plug the USB cable in, your phone should now appear when you type:

 # fastboot devices
 ZY3222HM8L Motorola Fastboot Interface

Find an official ROM for your phone

This is definitely the most risky and tricky part, as there is no foolproof way to determine which is the good ROM for your phone.

The least risky way is to use the Lenovo Rescue and Smart Assistant (LMSA) to download the ROM for your phone. However, DO NOT USE LMSA TO FLASH YOUR PHONE, IT WILL ERASE YOUR DATA.
Use LMSA to download the ROM, locate the zip archive it downloaded, and close it. LMSA requires Microsoft Windows, so this is not a viable solution for Linux users or MacOS users.

The other solution is to guess which ROM is appropriate for your phone, and download it from a public mirror. I used: https://mirrors.lolinet.com/firmware/moto/cedric/official/. Identify your model variant by looking at the information displayed by the bootloader. The important line is:

 Product/Variant: cedric XT1676 16GB P5

Try to explore the "RETAIL", "RETEU" (Retail EU), "RETUS" (Retail US) etc. depending on your country and try to find a an archive that matches your phone variant. Mine was in RETEU:


Make sure you download the last version for your phone (look at the dates, and version number 19-4-2) because the bootloader will not allow you to downgrade your OS.

Flash the ROM on your phone

Unzip the archive you just downloaded, then locate the flashfile.xml file. Open it with a text editor, and locate the <steps> block

<step operation="oem" var="fb_mode_set"/>
<step MD5="9f3a13b8222b08e2171d2519e5276c31" filename="gpt.bin" operation="flash" partition="partition"/>
<step MD5="9ea732d853c838d9ed8486ca6df10321" filename="bootloader.img" operation="flash" partition="bootloader"/>
<step MD5="3605a87a6e4ba36c2f995204a7ec2aa6" filename="NON-HLOS.bin" operation="flash" partition="modem"/>
<step MD5="77aec885e43c1441ae775a36add08125" filename="fsg.mbn" operation="flash" partition="fsg"/>
<step operation="erase" partition="modemst1"/>
<step operation="erase" partition="modemst2"/>
<step MD5="bded198b6f1d31e9ce664376503b223b" filename="adspso.bin" operation="flash" partition="dsp"/>
<step MD5="0f114b5a2ab83e18444fa0d8e79a8e0e" filename="logo.bin" operation="flash" partition="logo"/>
<step MD5="4559fd8bad5404d1ec16a98614b3765a" filename="boot.img" operation="flash" partition="boot"/>
<step MD5="864a8060abe29e56fe2e8e93cac2c4a3" filename="recovery.img" operation="flash" partition="recovery"/>
<step MD5="39b15d4e645ba9576e819edfaf5b668e" filename="system.img_sparsechunk.0" operation="flash" partition="system"/>
<step MD5="ed64b41d92f7cf5f4079442fc446e0af" filename="system.img_sparsechunk.1" operation="flash" partition="system"/>
<step MD5="aef832b70ded5b7b5788bf87b61a8ad6" filename="system.img_sparsechunk.2" operation="flash" partition="system"/>
<step MD5="31c52fe5f412ac621e325f879a08e6e8" filename="system.img_sparsechunk.3" operation="flash" partition="system"/>
<step MD5="982e8d23a01a1017c72c23c56aed3ca2" filename="system.img_sparsechunk.4" operation="flash" partition="system"/>
<step MD5="1ef6cd540e95e3fe2c80d934376b6f3a" filename="system.img_sparsechunk.5" operation="flash" partition="system"/>
<step MD5="66a2a34e2bacd1ab0f5065524e2ce141" filename="system.img_sparsechunk.6" operation="flash" partition="system"/>
<step MD5="052ca5a46c322450dacad5678c31ac0e" filename="system.img_sparsechunk.7" operation="flash" partition="system"/>
<step MD5="0a20486510c1c5f45d1d8dbfcf0b9975" filename="system.img_sparsechunk.8" operation="flash" partition="system"/>
<step MD5="1e60bbc27184845acdc99d789f503c0c" filename="oem.img" operation="flash" partition="oem"/>
<step operation="erase" partition="cache"/>
<step operation="erase" partition="userdata"/>
<step operation="erase" partition="DDR"/>
<step operation="oem" var="fb_mode_clear"/>

Then translate each step into a flashboot command, and write a script. However DO NOT TRANSLATE THE ERASE USERDATA AND ERASE DDR commands. In my case the script I wrote was as follows:

cat fastboot.sh
set -x
fastboot oem fb_mode_set
fastboot flash partition gpt.bin
fastboot flash bootloader bootloader.img
fastboot flash logo logo.bin
fastboot flash boot boot.img
fastboot flash recovery recovery.img
fastboot flash dsp adspso.bin
fastboot flash oem oem.img
fastboot flash system system.img_sparsechunk.0
fastboot flash system system.img_sparsechunk.1
fastboot flash system system.img_sparsechunk.2
fastboot flash system system.img_sparsechunk.3
fastboot flash system system.img_sparsechunk.4
fastboot flash system system.img_sparsechunk.5
fastboot flash system system.img_sparsechunk.6
fastboot flash system system.img_sparsechunk.7
fastboot flash system system.img_sparsechunk.8
fastboot flash modem NON-HLOS.bin
fastboot erase modemst1
fastboot erase modemst2
fastboot flash fsg fsg.mbn
fastboot erase cache
fastboot erase clogo

Again, make sure THERE IS NO erase userdata line. Make sure your phone is plugged securely, then you may then execute this script as root. It will flash your phone with the official ROM.

Once this is done, use the volume up and down keys on your phone to navigate to the "Start" entry and press power. Your phone should reboot, and hopefully your userdata partition will still be there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.