0

On every other phone I have owned (with CWM recovery) when I did a factory reset, it left my (internal) SD card contents intact. I wasn't thinking and did a factory reset and deleted everything.

As you all know reformatting a hard drive doesn't actually wipe the drive. From the looks of things the internal sd card is part of /data. So I took data's block device and did the following from ADB shell

I'm not looking up the exact paths but I believe I determined the block device to use by looking at "busybox df -h"s output

dd if=/dev/*--PATH-TO-mmblk-WHICH-DATA-IS-ON/ of=/cache/img1.img bs=1M count=1024
tar cvzf /cache/img1.tar.gz /cache/img1.img
*Copy img*.tar.gz to network share on my comp with ES file explorer
rm -f /cache/img*

dd if=/dev/*--PATH-TO-mmblk-WHICH-DATA-IS-ON/ of=/cache/img2.img bs=1M count=1024 offset=1024
tar cvzf /cache/img2.tar.gz /cache/img1.img
*Copy img*.tar.gz to network share on my comp with ES file explorer
rm -f /cache/img*


dd if=/dev/*--PATH-TO-mmblk-WHICH-DATA-IS-ON/ of=/cache/img3.img bs=1M count=1024 offset=2048
tar cvzf /cache/img3.tar.gz /cache/img1.img
*Copy img*.tar.gz to network share on my comp with ES file explorer
rm -f /cache/img*
,
.
.

I did this with all 10 or so GB of /data/ (forget actual size, but it's a 16GB model). I then opened these up in a hex editor and searched for known strings in my saved data (contents of messages from SMS backup & restore). I was unable to find my data. As far as texts are concerned I was able to find raw texts on my current device (not before I reset),

My question is, is the internal sd card on a different partiton than /data/?

1

It appears that the internal SD card is on the same partition as /data (I verified with my GT-I9500 at XXUEMJ9 - 4.3, output below):

root@ja3g:/storage/emulated/legacy # df                                        
Filesystem               Size     Used     Free   Blksize
/dev                   931.8M    76.0K   931.8M   4096
/mnt/secure            931.8M     0.0K   931.8M   4096
/mnt/asec              931.8M     0.0K   931.8M   4096
/mnt/obb               931.8M     0.0K   931.8M   4096
/system                  2.7G     2.1G   588.6M   4096
/efs                    19.7M     9.2M    10.5M   4096
/cache                   2.0G    32.6M     1.9G   4096
/data                    8.8G     8.3G   540.4M   4096
/persdata/absolute      11.8M     4.2M     7.6M   4096
/mnt/shell/emulated      8.8G     8.3G   520.4M   4096
/mnt/shell/container     8.8G     8.3G   520.4M   4096
/mnt/ntfs              931.8M     0.0K   931.8M   4096
/storage/emulated      931.8M     0.0K   931.8M   4096
/storage/extSdCard      14.8G    10.4G     4.4G   8192
/storage/emulated/0      8.8G     8.3G   520.4M   4096
/storage/emulated/0/Android/obb     8.8G     8.3G   520.4M   4096
/storage/emulated/legacy     8.8G     8.3G   520.4M   4096
/storage/emulated/legacy/Android/obb     8.8G     8.3G   520.4M   4096

Some other manufacturers have different implementations of the layout; in fact, this decision was the largest possible reason why the Mass Storage option disappeared and MTP had to be used - because /data used ext4 which most Windows PCs can't recognize.

Some CWM versions do not perform a format on /data when you request for a factory reset - that is because they are either:

  1. Running on a pre-3.0 version of Android that uses the older implementation
  2. Using a manufacturer-defined custom layout
  3. Running custom "Factory Reset" code that does only rm -rf on the folders

As to why the plaintext cannot be found, I'm not entirely sure - but I thought it might have to do with the formatting being done with secure erase (MMC_CAP_ERASE).

More information can be found here: http://teamw.in/DataMedia

And in the 4.2 source code itself: https://android.googlesource.com/platform/docs/source.android.com/+/android-4.2.1_r1/src/tech/storage/index.md

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.