So it came to pass, that Amanda did have a blonde moment and deleted all her threads in the SMS app by mistake. Yeah, "Delete all threads" probably shouldn't be quite so easy to invoke.

The phone's a ZTE Blade, with all its user data inconveniently stored on a YAFFS2 filesystem.

I have an old back up, but the SMS I need to recover are from since then. There are probably some on the SIM card, so I've ordered a SIM reader. I suspect that the twenty or so it holds are mostly network operator spam, anyway.

So, I curse my ineffectual backup plan and vow to back up SMS to GMail in future.

Meanwhile, I resolve to recover mmssms.db, or what's left of it.

First up, I connect adb and check the mounts, then attempt to copy the block to an image on the SD card:

dd if=/dev/block/mtdblock6 of=/sdcard/data.img 

No such luck. I reason forcibly dismounting would be a bad idea, and probably won't work in any case.

So, I upload a statically linked copy of busybox to the SD card and use the conv=noerror option.

What I ended up with was a file that kept increasing in size until the SD card filled up.

What am I doing wrong? Does ClockworkMod take an image in the true sense or does it just back the files up and pack them into an image? Is there a YAFFS2 recovery program? (The two papers I've read make it seem feasible but I haven't seen even PoC code)

Any clues gratefully received/

Edit: The phone is rooted. Very rooted :)

Further edit:

Most of the messages found in mmssms.db-wal:

ls -al /data/data/com.android.providers.telephony/databases
drwxrwx--x    1 radio    radio         2048 Jul 17 20:16 .
drwxr-xr-x    1 radio    radio         2048 Oct 26  2011 ..
-rw-rw----    1 root     root         60416 Jul 17 20:16 mmssms.db
-rw-rw----    1 radio    radio        32768 Jul 17 16:18 mmssms.db-shm
-rw-rw----    1 radio    radio       628832 Jun 30 19:23 mmssms.db-wal
-rw-rw-rw-    1 root     root         60416 Jul 17 20:16 mmssms.db.xxx
-rw-rw----    1 radio    radio       132096 Jun 18 13:25 telephony.db
-rw-rw----    1 radio    radio        32768 Jul 16 22:14 telephony.db-shm
-rw-rw----    1 radio    radio       106928 Jul 16 22:14 telephony.db-wal

With any luck, SMS Backup & Restore will allow a merge.

  • Is your blade rooted?
    – t0mm13b
    Commented Jul 16, 2012 at 18:56
  • @Mandy: Regarding your other question: Yaffs2 is a flash file system that has wear leveling protection for the underlying flash storage (it has a log structered data model where writes are not in place but instead go always to the tail of the "log" and old unused space is reclaimed from the head. Very simply explained). If you didn't write too much you probably can find older instances of files. By ignoring the part of the tail from just before the delete you could be lucky. Haven't done file carving for YAFFS2 so far tho.
    – ce4
    Commented Jul 19, 2012 at 8:12
  • Might help: How to recover a deleted file from /data partition? Commented Dec 14, 2019 at 21:09

1 Answer 1


The sms database is stored in /data/data/com.android.providers.telephony/databases/mmssms.db which is what you want to do.

Best thing to do, is this, do not plug in USB cable yet:

  1. Reboot into ClockWorkmod Recovery.
  2. Go into Mounts and Storage
  3. Select mount /data
  4. Plug in the USB
  5. From the windows command shell or terminal, adb shell
  6. Since you are in ClockworkMod Recovery, you are root by default, now do this cp /data/data/com.android.providers.telephony/databases/mmssms.db /sdcard/MySmsDatabase.db
  7. exit out of the adb shell by typing in this: exit
  8. Now your database is copied to the SD-Card.
  9. Back out of ClockworkMod recovery and just reboot, the recovery will unmount /data for you.

At this stage your database is now copied across. And can be safely extracted via using something like SqliteMan. HTH.

Edit: The OP was interested to know how a dump can be done. - Read on :)

When you invoke this (with USB plugged in and within the adb shell)

sh-4.1# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00500000 00020000 "recovery"
mtd1: 00500000 00020000 "boot"
mtd2: 00120000 00020000 "splash"
mtd3: 00080000 00020000 "misc"
mtd4: 02580000 00020000 "cache"
mtd5: 0d700000 00020000 "system"
mtd6: 0cb80000 00020000 "userdata"
mtd7: 00020000 00020000 "oem"
mtd8: 00180000 00020000 "persist"

Knowing which partition is the key.. So for example from my Blade, I can see that userdata is on the partition mtd6, in which the actual partition information can be found within /dev/mtd/mtdX so its a matter of doing this using cat:

cat /dev/mtd/mtd6 > /sdcard/myuserdata.dump

And from there, taking the /sdcard/myuserdata.dump, depending on the filesystem used on that partition, it can be mounted via loop-back. The mileage will vary and of course, its a chicken-and-egg situation, in order to do all of that, the handset needs to be rooted.

  • That was most helpful, all (or at least most) of the deleted SMS were in mmssms.db-wal: Many thanks for the useful pointer!
    – Mandy
    Commented Jul 17, 2012 at 19:32
  • Now just need to convince sqlite it really does want to take the WAL file and revert those DELETE FROM statements to the mmssms.db. If I get a breakthrough I'll post the outcome here as this is typically what someone searching for a way to restore deleted SMS threads would be looking for.
    – Mandy
    Commented Jul 19, 2012 at 0:01
  • here's an answer how to get a whole partition off a device. Needs Linux, an adb enabled CWM recovery and knowledge of your device's partition layout (i.e. whats the /data partition's device, /dev/block/?)
    – ce4
    Commented Jul 19, 2012 at 7:18
  • @t0mm13b: Yaffs2 cannot be mounted using the loop-back technique. Yaffs2 is a flash file system and depends heavily on a 'MTD chip', see Wikipedia for more. (It's due to some NAND's extra bytes per area that are used for wear leveling and are not part of the real data). If you read the block device you only get the user-visible data, not the extra flags back. If you want to mount a YAFFS2 image, you need a MTD simulator (the Android SDK has one included, you can specify an additional .img for a VM (or overwrite the data.img))
    – ce4
    Commented Jul 19, 2012 at 8:17
  • Has this moved? I can't find /dev/mtd/* at all, under 4.4.4 on an s5 ... instead it seems userdata is mounted from this block device: /dev/block/platform/msm_sdcc.1/by-name/userdata Commented Jul 17, 2015 at 12:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .