2

My phone is a Motorola MOTO G (first generation). Due to some troubles, I had recovered the factory settings of my phone. But I forget to backup some data of an app (Tricount). A this point my phone was not rooted.

My question is: is it possible to recover the data files of this application?

Currently, I just rooted my phone and I am currently making a RAW copy of the android system using command adb shell su -c "cat /dev/block/mmcblk0" | pv > mmcblk0.raw. My idea is to used extundelete command to recover the files after extracted the partitions using Testdisk.

Do you recommend to search files in a specific partition? I am not really familiar with the android filesystem...

EDIT: One other method (I don't have tested yet). In terminal 1

adb forward tcp:5555 tcp:5555

adb shell

su

/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12

In terminal 2

adb forward tcp:5555 tcp:5555

nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw

NB: websites:

EDIT: unfortunately, it seems that Android overwrites the files when you recover the factory settings (for security raesons) and so it is impossible to recover the files... :-(

Improve this question
13
  • based on the conversation in the answer below, take a look at this link. I have no actual experience with any of this, and from your question, you know more about this than I do. I hope you are able to recover. Good luck. (I hope you stick around here and help others with their data recovery problems in the future :))
    – Ryan Conrad
    Jan 2, 2015 at 17:59
  • 1
    @RyanConrad ;-) I am already following this link. But I am not sure that the extracting command is good. Currently I can only extract a 4gb+ RAW file but my phone normally have 16gb...
    – Guuk
    Jan 2, 2015 at 18:02
  • 1
    @RyanConrad One command to know on which partition is userdata: ls -al /dev/block/platform/msm_sdcc.1/by-name/. I obtain one line with : lrwxrwxrwx root root 1970-09-23 09:51 userdata -> /dev/block/mmcblk0p36...
    – Guuk
    Jan 2, 2015 at 18:15
  • 1
    I don't have sufficient level so I propose one new link : !!! forum.xda-developers.com/showthread.php?t=1818321
    – Guuk
    Jan 2, 2015 at 18:50
  • 1
    @RyanConrad I am currently creating the image using dd. About 1h for 16gb....
    – Guuk
    Jan 2, 2015 at 19:33

1 Answer 1

Reset to default
0

What kind of App is Tricount? Meaning is it came pre-installed in your phone or you download it from Play store such as Google Play Store?

Answer to above question is IMP as Android File system maintain clear distinction between system apps (which are shipped by your device OEM) and Downloaded apps.

Assuming that it is a downloaded app, you can check below location: /data/data/app-package-name Where app-package-name is the name of the package (Given by the Developer who developed Tricount app).

Improve this answer
8
  • Tricount is an app I have downloaded on the Google Play Store.
    – Guuk
    Jan 2, 2015 at 17:48
  • You can check for /data/data/app-package-name for Tricount. All it's data (including databases used internally by app), will be held inside it.
    – AADAndroidEnthusiasts
    Jan 2, 2015 at 17:50
  • Even if it was a system app, the "data" for the app is stored in the "user data" on the system storage. This "user data" is cleared when you perform a factory reset. In short, unless the app syncs data to google cloud services, the likelihood of you able to recover it is slim (at best)
    – Ryan Conrad
    Jan 2, 2015 at 17:51
  • 1
    @RyanConrad but the files is rewrited or just deleted? My idea is to use recovery tools...
    – Guuk
    Jan 2, 2015 at 17:53
  • 1
    @RyanConrad I agree with you. But I want to try. What do you think about my command to extract a RAW copy of the data?
    – Guuk
    Jan 2, 2015 at 18:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .