I'm trying to evaluate the options for recovering some important files that were deleted from a Moto G 1st generation. I have sufficient experience with the data recovery itself once I have an image file, and I know how to extract an image of the /sdcard partition once the phone is rooted.
However, I see the following problems:
The phone isn't rooted, and the bootloader is still locked. Unlocking the bootloader will wipe the phone.
The phone is updated to Android 4.4.4 . Therefore it isn't possible to root it without unlocking the bootloader. (this seemed to work for 4.4.2 , but a downgrade requires an unlocked bootloader)
What I think might be a solution:
- Backup to PC with adb
- Unlock bootloader (wipes all data!)
- Root phone
- Extract image of /sdcard partition to PC
- Recover files on PC using the usual forensics tools
- Maybe lock bootloader again/unroot phone (still tbd)
- Restore backuped files with adb
Questions:
Is the wipe during bootloader unlocking just a normal "delete" (quick-format) operation or will the whole partition be overwritten? If the former, will I have chances to recover the files, with the usual caveats (i.e. files not overwritten yet by new files). If the latter, I prefer to avoid this tedious procedure...
Does the procedure make sense or am I missing something important?