? How to recover deleted files on rooted Android without USB Debug & PC connection? - Android Q&A, Help & Troubleshooting

? How to recover deleted files on rooted Android without USB Debug & PC connection?
Hello.
I have removed some important files in my DCIM folder on internal memory of my Android device. The USB socket of the phone is broken so I couldn't use any recovery software that using USB debug mode but I have Team Win I want to use the terminal of Team Win to make an image and copy it to SD Card of my Android device. I know that there is a command dd but how to use it in a proper way to make a full image of the partition including also free space.
Thank you very much in advance!

---

Yes, dd command could be used simmilar to this:
open terminal, cd to external SD folder
dd if=/dev/block/block/bootdevice/by-name/userdata of=data.img
or if you know number of partition
dd if=/dev/block/mmcblk0p18 of=data.img (p18 is on Huawei LDN, image size is that same as partition size 16GB/32GB/64GB..etc, so for bigger then 32GB need to use NTFS sdcard or exFAT sdcard and TWRP also has to support NTFS or exFAT).
Or edit etc/*.fstab and repack twrp. You can back up files from /data for now (as ext4 or f2fs). Just add line to back up full image of /data (as emmc).
If /data has ext4 filesystem it can easilly mount/unpack/scan/rip image. But if /data has f2fs ... got not cure.
Example:
/data f2fs /dev/block/bootdevice/by-name/userdata flags=length=-16384;backup=1;settingsstorage;encryptable=footer;
/data_image emmc /dev/block/mmcblk0p55 flags=display="Data Image";backup=1;flashimg;

---

adeii said:
Yes, dd command could be used simmilar to this:
open terminal, cd to external SD folder
dd if=/dev/block/block/bootdevice/by-name/userdata of=data.img
or if you know number of partition
dd if=/dev/block/mmcblk0p18 of=data.img (p18 is on Huawei LDN, image size is that same as partition size 16GB/32GB/64GB..etc, so for bigger then 32GB need to use NTFS sdcard or exFAT sdcard and TWRP also has to support NTFS or exFAT).
Or edit etc/*.fstab and repack twrp. You can back up files from /data for now (as ext4 or f2fs). Just add line to back up full image of /data (as emmc).
If /data has ext4 filesystem it can easilly mount/unpack/scan/rip image. But if /data has f2fs ... got not cure.
Example:
/data f2fs /dev/block/bootdevice/by-name/userdata flags=length=-16384;backup=1;settingsstorage;encryptable=footer;
/data_image emmc /dev/block/mmcblk0p55 flags=display="Data Image";backup=1;flashimg;
Click to expand...
Click to collapse
Thank you very much for you point to point reply!
Finally, I choose to use that option with some modifications because vfat doesn't support files larger than 4GB.
Code:
dd if=/dev/block/bootdevice/by-name/userdata conv=noerror,sync bs=100M | gzip -c | split -b1000000000 - mybackup.img.gz

---

I have mounted this *.img partition using OSFMount for Windows. But after the scanning process (I was using R-Studio that supports ext4 file system I found my deleted files in the tree structure /media/0/DCIM/Camera but all of the deleted files has 0 bytes size and have 2 flags: deleted, wiped.
I couldn't understand how that happened. I mean I didn't use my phone after deleting files at all. I also mounted this *.img as raw disk in Active Undelete but the result is actually the same all of the deleted files have 0 bytes file size.
Is that a bug of the program? Or I have made an image using wrong command? Or Android 9 actually wiping files after deletion?
The files have been accidentally deleted by AirDroid-web app but I don't think so that this app is wiping deleted files it doesn't make sense...

---

RaTr said:
Thank you very much for you point to point reply!
Click to expand...
Click to collapse
You are welcome. Thank you are for note about 4GB file size limit on vfat/fat32, will save us from a lot of headache.
---------- Post added at 10:03 AM ---------- Previous post was at 09:49 AM ----------
RaTr said:
actually the same all of the deleted files have 0 bytes file size.
Click to expand...
Click to collapse
Maybe to try DiskDigger on phone if it is rooted to scan internal sd?
PhotoRec for Windows/Linux: https://www.cgsecurity.org/wiki/PhotoRec_Step_By_Step
There are few programs to try on your image on GNU/Linux like extundelete, ext4magic, AnalyzeEXT, ext3grep ...
Source: https://askubuntu.com/questions/217606/undelete-files-on-ext4

---

I am trying to use ext4magic to recover deleted files. But I need a copy of the journal when I am trying to use command
Code:
debugfs -R "dump <8> /var/tmp/home.journal" /dev/mapper/home
I see that Team win terminal do not have this command how to add it or how to make a copy of the journal of my ext4 partition where I am trying to recover my files.

---

adeii said:
Maybe to try DiskDigger on phone if it is rooted to scan internal sd?
Click to expand...
Click to collapse
I have tried to use DiskDigger. When I am putting a filter to show only deleted files it doesn't show anything. Which is pretty strange.
adeii said:
There are few programs to try on your image on GNU/Linux like extundelete, ext4magic, AnalyzeEXT, ext3grep ...
Source: https://askubuntu.com/questions/217606/undelete-files-on-ext4
Click to expand...
Click to collapse
Next program that I have tried was TestDisk but looks like it doesn´t support ext4 file system.
Thank you for the advice about PhotoRec. It has support of ext4 system. But it won't help. So, there are still some options. I will try to use extundelete as the next one.

---

If you have an image of EXT4, then you can use 7-Zip Archiver to read all the files inside it.

---

jwoegerbauer said:
If you have an image of EXT4, then you can use 7-Zip Archiver to read all the files inside it.
Click to expand...
Click to collapse
7-Zip will show deleted files also?..

---

I have tried 2 more utilities:
1. ext4magic without external journal file. It has done the job but I couldn't find any files that I need.
2. extundelete that program restored less files and also no files that I want to recover.
One more strange thing:
I have installed R-Studio and opened my image there. I fount full list of my deleted files, but all of the records of my deleted files have 2 flags: deleted, wiped and it shows me that the size of that specific files is 0 bytes.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
I have checked other files from different dates, they can be recovered, there is no flag wiped and also I can see the size, in some of them there is a flag cross-link, but I think it is normal, that means part of that file is already overwritten by another one.

---

RaTr said:
I have tried 2 more utilities:
1. ext4magic without external journal file. It has done the job but I couldn't find any files that I need.
2. extundelete that program restored less files and also no files that I want to recover.
One more strange thing:
I have installed R-Studio and opened my image there. I fount full list of my deleted files, but all of the records of my deleted files have 2 flags: deleted, wiped and it shows me that the size of that specific files is 0 bytes.
I have checked other files from different dates, they can be recovered, there is no flag wiped and also I can see the size, in some of them there is a flag cross-link, but I think it is normal, that means part of that file is already overwritten by another one.
Click to expand...
Click to collapse
I am stuck in the same situation bro
See it here I described the issue very similar to yours. Any luck in trying to recover that `ext4` data

---

RaTr said:
I found my deleted files in the tree structure /media/0/DCIM/Camera but all of the deleted files has 0 bytes size and have 2 flags: deleted, wiped.
Click to expand...
Click to collapse
expected.
emmc/ufs flash storage is handled different from hard disk drive. there is FTL controller with own firmware that is wear-leveling whole storage all the time. not to mention files are fragmented.
file system sends TRIM on each deletion of file. note the discard mount flag for userdata partition.
Android 4.3 Update Brings TRIM to All Nexus Devices
www.anandtech.com

---

Hi, I tried dd command, and it returned
Code:
dd: data.img: Read-only file system
But ./adb pull /dev/block/mmcblk0p57 57.img worked, and created a NDIF image.
Why dd did not work?
And which format of image would dd create?
Thanks.

---

you're trying to write into phones / rootdir. you cannot dump partition into phone itself. external MicroSD card or OTG pendrive is required. but you could redirect to stdout into remote file (note the quotes make the difference where > redirection is executed)
Code:
adb root
adb shell 'dd if=/dev/block/mmcblk0p57 bs=1m status=none' > data.img
open data.img file with HxD editor and have a look into first bytes. search for magic 53 ef at offset 0x438 to confirm it's ext4 image.
dd is useful in case no usb connection available (topic of thread). the result is same as adb pull. you can increase speed with block size (bs= default 512 bytes) up to 1 MB.
Note: on FDE encrypted phone one can't pull userdata directly. instead pull whatever is mounted /data (like /dev/block/dm-0)

---

aIecxs said:
you're trying to write into phones / rootdir. you cannot dump partition into phone itself. external MicroSD card or OTG pendrive is required. but you could redirect to stdout into remote file (note the quotes make the difference where > redirection is executed)
Code:
adb root
adb shell 'dd if=/dev/block/mmcblk0p57 bs=1m status=none' > data.img
open data.img file with HxD editor and have a look into first bytes. search for magic 53 ef at offset 0x438 to confirm it's ext4 image.
dd is useful in case no usb connection available (topic of thread). the result is same as adb pull. you can increase speed with block size (bs= default 512 bytes) up to 1 MB.
Note: on FDE encrypted phone one can't pull userdata directly. instead pull whatever is mounted /data (like /dev/block/dm-0)
Click to expand...
Click to collapse
Thanks for your reply.
What would be the differences between
adb shell 'dd if=/dev/block/mmcblk0p57 bs=1m status=none' > data.img
and
the method described in this message: https://stackoverflow.com/a/41214172 ?
Thanks.

---

streaming over netcat avoids unwanted characters using stty raw. on macOS probably result is no difference (after unpacking gzip).
you don't need this as you wrote adb pull worked (which is the easiest method)

---

aIecxs said:
streaming over netcat avoids unwanted characters using stty raw. on macOS probably result is no difference (after unpacking gzip).
you don't need this as you wrote adb pull worked (which is the easiest method)
Click to expand...
Click to collapse
Thanks.
I searched Hex in 57dd.img created by adb shell 'dd if=/dev/block/mmcblk0p57 bs=1m status=none' > 57dd.img.
It showed
Is the 53EF on line 1080 in the image above is the one you mentioned "at offset 0x438"?

---

right, that is ext4 magic at offset/byte hex (0x438)16 = (1080)10 dec

---

I have a slightly different but related question /problem. My apologies if this is not the right place to post.
On my Samsung A10e, TWRP (and other recoveries) gives me a tarfork 255 error when trying to backup userdata. Normally this should be 32GB in size from Samsung specs.
I have used two alternatives :
* adb pull /dev/block/by-name/userdata data.img which creates a 26G file on my linux PC, that I can mount and inspect. When I run filesystem check it throws out errors, probably due to some of the data being encrypted - I am running AOSP Android 11 gsi. Perhaps the same errors that prevents TWRP from working ?
* alternatively I have put in a clean 32GB SD card, then via adb shell run dd if=/dev/block/by-name/userdata of=/dev/block/mmcblk1p1 to copy the full userdata partition over to the SD card. Once removed from the phone and put in a card reader, again this can be inspected on my linux PC, and gives the same filesystem check errors. I also ran dd if=/dev/external_sd of=data2.img on my linux PC to create a similar image file as adb pull but it is now the full 32GB that I would have intially expected.
So why the size difference between adb pull and dd ?? Does adb pull actually get everything - in other words if I try and restore with adb push will the phone recover to previous state and boot ?
I was hoping to then reduce the size of my data copy to 16GB since on my phone I am only using 12GB of the 32GB, but file errors are preventing me at the moment.
I was thinking about wiping data and then with arm32 parted and adb shell creating a 16GB userdata partition and an additional 16GB user shadow partition - the latter only to be used locally via dd to do backup and restore and avoid TWRP errors.

---

that is very lightly due to encryption issues....esp Magisk is known to break encryption.
if you can decrypt at TWRP level and then proceed to backup user data via ADB shell to memory card that is your best bed and then wipe the partition and then restore your app data individually for apps that you need e.g. contacts db for contact an SMS. I strongly doubt if you will be able to restore that entire partition and boot to that original partition successfully.... it may have become what what we can call "encryption tainted"
excuse my typos