I want to know if it's possible to get a "disk image" of the storage space on Android devices when they don't use external storage like SD cards.

I'm mostly interested because my kids factory reset my Kindle Fire HDX and I was hoping I could get a disk image (using something like dd in Linux) and then try to recover some of the user data like photos and videos (using something like PhotoRec, http://www.cgsecurity.org/wiki/PhotoRec). I've done this lots of times with SD cards and hard disks by simply mounting the storage device in a desktop running Debian, and executing something like:

# dd if=/dev/sdb1 of=image.iso

Then you can use PhotoRec and/or TestDisk, depending on what you want, to get useful stuff out of the image file.

Even some of my very old Android devices seem to allow mounting a storage device in this way (without removing SD card from the phone) and following this process. Unfortunately, it looks like many new devices that don't have removable storage (like my Kindle Fire HDX and my Nexus 5) only allow you to interface with a computer using Media Transfer Protocol (MTP) and Picture Transfer Protocol (PTP).

Can I use these protocols to get a bit-by-bit copy of the storage in the device? Is there a way to add the older storage device capabilities to new phones?


After doing some more research, I think I've found a partial solution here:


  • First, you need to get ADB set up on your computer. In Linux it's pretty easy. Something like running # apt-get install android-tools-adb or downloading and extracting a directory.

  • Find your partitions. Run something like: adb shell cat /proc/partitions There are other options in the link for how to find and identify all the partitions.

  • Copy the data The dd tool should be available. You can run something like dd if=/dev/block/mmcblk0p9 of=/sdcard/image.img

Unfortunately, I have two problems with this. The first is that the permissions on partition devices might require root access. The second is that the Kindle Fire HDX and many other modern devices that don't have "USB Mass Storage" also don't use SD cards. So there is no easy location to write the image you want that isn't already used for something else on the device.

I'm trying to find a way to mount network devices or transfer data over USB between the device and computer (adb push and adb pull won't do what's needed as far as I can tell). I'll update this if I can find a good solution. Otherwise I'll ask some other questions about it.

Edit: This page has a great description along the lines of what I have above: http://www.df.lth.se/~jokke/androidfilerecovery/

As noted below, root is necessary, but there are usually lots of ways to get that easily. Unfortunately, I was working with the Fire HDX 8.9. Halfway through my copying data to an image file, the thing auto downloads an update to 4.1.1. Next thing I know, root access disappears and I don't think there's an exploit out for it yet. I probably lost any recoverable data after the update was written to the internal storage anyway. I'm so frustrated with Amazon lately...

  • You're correct: No way to get a dd dump without root access. As for the copying, AFAIK there are ways to "bridge" it via USB to the other end: I've seen an article describing that somewhere, but don't remember where that was :( Basically: re-directing the output of dd like adb shell "dd ..." > /localdir/file.dump, where localdir resides on your computer. – Izzy Nov 18 '14 at 17:31
  • 2
    Thanks. That looks like the ideal solution. I've updated my answer. There's a great page on this process at: df.lth.se/~jokke/androidfilerecovery (I still can't believe how long it took me to find it). – Joshua Nov 19 '14 at 0:22
  • Yes! Exactly that was what I had in mind. Glead I could at least provide the correct pointer :) // Btw: as it is preferable to include the essentials with your answer (the link might die one day), mind to do so with your answer? Or would you prefer I put a separate answer doing that? – Izzy Nov 19 '14 at 10:34
  • It would've been nice to include the exact procedure from the link, instead just linking to it. Links die sometimes. Also, the update goes to the system partition. There's no reason why It'd have overwritten the data partition as well. – TJJ Feb 7 '17 at 17:41

Joshua pretty much answered the question. However, Izzy gave extra insight to tackle them odd/rare variations of the same problem.

I would like to contribute (my first contribution post in over 10 years) for those who would stumble into the very same scenario as I did. Anyways, 24 hours later, with persistent and determination, the following command will shed some light (assuming you've intermediate/advanced skills already).

Btw, I won't be explaining it, as the command itself is pretty obvious.

adb shell "dd if=/dev/block/mmcblk0p37 of=/dev/pts/0" > part37-img-dump.dd

These are the tools I used to get the job done.

 |--\adb.exe (version 1.0.31 21/05/2013, latest was buggy)
 |--\fastboot.exe (version fc2a139a55f5-android 24/04/2016)
 |--\part37-img-dump.dd (output from the 'adb' command)


  1. dd will output stats to stdout after completion (BusyBox related)
  2. find a tool to trim the unwanted offsets at the EOF (not a must to do)
  3. mount the image using the preferred data recovery software or whatever
  4. /dev/pts/0 should work straight up, but if you happen to be running multiple adb shell command from multiple console/terminal, then be careful of the dev pointer ref number as it will be different. By using the following command, you can simply figure out which one: pts:0, pts:1, ...
    adb shell "ps -l"
  • In my case I've used adb shell su -c "dd if=/dev/block/mmcblk0" | pv > backup.dd ... if haven't pv... apt-get install pv or remove of the line – Milor123 Jan 26 '17 at 16:33

This line: adb pull /Dev/block/device-by-name/userdata data.img should work. I didn't test it out but should be close. This would pull the whole image which you could flash or maybe push later in the process of restoring. It only works if you're rooted. I won't work when you aren't. Permissions error. I am guessing if you did fastboot with TWRP and not rooted, if you get decrypt working, you can copy the image that way. I am avoiding rooting right now. Seems to be more stable with Android 10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.