Hi, I accidently master reset my atrix 2 and want to recover SMS from my device memory
I have done the following
- rooted my phone and activated CWM recovery but I am not able to access the internal memory as USB device so I can run any recovery program
- I tried to access the mmssms.db file in /data/data/com.android.providers.telephony/databases/mmssms.db through command prompt but the file is only 42KB, which means a blank file is created.
Is there a way I can access the internal memory as USB device?
or
are there any SU or ADB commands by which I can restore mmssms.db to an older date?
or
Any linux commands i can run to read the data on physical blocks (assuming some blocks of memory will still have some data even if the file is overwritten or the new .db file is not necessarily at the same physical location)
Any Linux developers out there who can help me with any commands to try?
As flash memory is actually erased, not just marked as no longer in use (like magnetic media) there may be no way to get you data back. However this is not ALWAYS the case, but I think it would be pretty difficult.
You may be able to dd the partition where your data was to a file on the sd card and then try to recover data from that once you transfer it to your pc.
Related
Hi,
My friend has a Sensation with a broken LCD. His contacts are stored on the internal memory and not synced to google. While they are his main concern, I'd also like to get a backup of other data if possible.
The phone is not rooted, S-ON etc. and USB debugging is not on. It's pretty much stock.
I am able to get into fastboot, but that is about it.
Running through a few options, I managed to adb into my (rooted, with USB debugging) DHD and pull the contacts2.db file. I'm thinking backup over adb is going to be my best bet, but I'm not sure how to connect to the Sensation.
Is it possible to turn USB debugging on without access to the screen? Is there another way I can adb into the phone? Or perhaps another way I could access the internal memory?
Cheers
If I can get an adb connection, can I temproot, tar the app data and then transfer it to the SD/pull it over adb?
I've read that adb can be accessed through recovery, does this apply to the stock recovery? I've tried accessing it, but I'm still unable to make a connection.
I think I could flash another recovery without use of the screen, but getting S-OFF first could be a whole other issue.
Can anyone offer some advice?
It's unfortunate that this went unanswered, because now I have the exact same problem on my wife's phone. All stock - just want to be able to grab contacts and sms/mms data if possible. Other backups would be great.
if usb debugging is enabled and adb is working then backing up some data is possible
you need to have a sdcard in phone too...with atleast 1.5 GB of space
adb devices (check whether devices got connected or not)
adb shell
mkdir /sdcard/tmp_data
cp -rf /data/* /sdcard/tmp_data/
the above commands might probably copy the stuff from /data partition to /sdcard/tmp_data
the data partition has all data ..contacts ,call logs, sms logs, even user apps and its data
I got into bootloop after installing some apps and I am just wondering if I can access my nandroid backup folder on my PC....coz apparently I need to change the folder name in order to get rid of "MD5 mismatch" during restoration in clockwork mod recovery.
Thanks in advance.
By default, the backup folder is on the sd card. If your device has a removable card, you can just put it into your pc & access it. You can also access it through USB by using adb commands, but you must have previously turned on debugging mode in the settings.
It's also handy to have AROMA Filemanager on your sd card. You flash it in recovery like any other zip (it doesn't make any changes, just launches the file manager). It also comes with a terminal emulator. It's quite powerful, and extremely handy when you can't get your system to boot up.
Hey guys, I've found a way to recover files from the INTERNAL Memory of the Samsung Galaxy S4.
A lot of people have said that it's not possible, but I'm here to prove them wrong.
You have to have rooted your phone before carrying out these steps. Don't post here asking for help rooting, there's plenty of other threads that can help you with that.
I hold zero liability in the event that you make a nice brick out of your phone. If you do not feel comfortable working with these commands, then please don't follow them.
You're going to need an SD Card that's at least the size of the internal memory on the phone. A smaller one would work, but keep in mind not all the files are going to be recovered.
If the SD Card is brand spanking new, you can skip step number 1.
Format the SDCard with a layer of 0's. This is done so that none of the old data will interfere with your recovery. This step is optional.
Root the Device
Install Terminal Emulator
Insert the SDCard
In Terminal Emulator run the command to gain super user privileges
Code:
su
Grant Terminal Emulator super user privileges
Run this command,
Code:
dd if=/dev/block/mmcblk0p29 of=/storage/extSdCard/raw.dd
Wait. Leave your phone plugged into an AC Adapter, and go grab a can of pop. This command will take a looong time. Couple hours to a day.
Once the command is finished running, shutdown your phone.
Remove the SDCard, and connect it to a computer
Download TestDisk
Open PhotoRec
Select the SDCard and press enter
Use the first option of "Unknown"
Then press "Other"
Select the Directory to backup the files to
Profit
'
How it works:
By dd'ing the internal memory to a file on the SDCard, you're doing a raw copy of the data.
Once the data is copied onto the SDCard, PhotoRec will scan the SDCard for deleted data, doing so will scan the raw file for photos. Not just photos, all files can be recovered using this method.
This method works on all rootable phones, provided you can figure out where the dev block for the internal memory is.
Hope you guys get your files recovered. I know I did
Or just install a file recovery app from play store on a rooted phone and follow app instructions...
Worked a charm for me. lol
jamieridler said:
Or just install a file recovery app from play store on a rooted phone and follow app instructions...
Worked a charm for me. lol
Click to expand...
Click to collapse
Any app you recommend in particular?
Bingley said:
Any app you recommend in particular?
Click to expand...
Click to collapse
Tbh I just downloaded the first app I came across that was free and had half decent reviews, can't remember what one, it was a little while ago, but there are loads of them in the store.
jamieridler said:
Or just install a file recovery app from play store on a rooted phone and follow app instructions...
Worked a charm for me. lol
Click to expand...
Click to collapse
A lot of those apps are for the external SD Card, only support the FAT filesystem, and not as robust as PhotoRec from TestDisk.
Newer devices(Such as the S4) have an ext3 filesystem I believe, and a few paid apps claim to offer support for it.
... Not to mention TestDisk is Open Source :angel:
zzarzzur said:
A lot of those apps are for the external SD Card, only support the FAT filesystem, and not as robust as PhotoRec from TestDisk.
Newer devices(Such as the S4) have an ext3 filesystem I believe, and a few paid apps claim to offer support for it.
... Not to mention TestDisk is Open Source :angel:
Click to expand...
Click to collapse
Although some might well be limited to FAT filesystem, some are not, its up to the user to check before downloading and installing. After that rather simple search and install, I managed to recover every img file on my phone, current and deleted, and back it all up to external memory, all with a free app, which offers img file recovery for free and any other file type of your choice for a small, one off, cost, if you needed it. I recovered almost 1gb of img files in under 10 minutes.
Am I correct in assuming your method copies the entire contents of the internal memory, or a portion of it, to an SD card before starting the search for deleted files? I'm just an amateur with little knowledge trying to figure out how your method works. Sorry don't mean to bash your method of doing it either, just commenting on this as your post suggest no one has ever been able to do this before and your method is the one and only way it can be done.
But if the device is factory reset, will you be able to get files? If i sell my device i don't want anyone sneaking on my photos.
problems
zzarzzur said:
Hey guys, I've found a way to recover files from the INTERNAL Memory of the Samsung Galaxy S4.
A lot of people have said that it's not possible, but I'm here to prove them wrong.
You have to have rooted your phone before carrying out these steps. Don't post here asking for help rooting, there's plenty of other threads that can help you with that.
I hold zero liability in the event that you make a nice brick out of your phone. If you do not feel comfortable working with these commands, then please don't follow them.
You're going to need an SD Card that's at least the size of the internal memory on the phone. A smaller one would work, but keep in mind not all the files are going to be recovered.
If the SD Card is brand spanking new, you can skip step number 1.
Format the SDCard with a layer of 0's. This is done so that none of the old data will interfere with your recovery. This step is optional.
Root the Device
Install Terminal Emulator
Insert the SDCard
In Terminal Emulator run the command to gain super user privileges
Code:
su
Grant Terminal Emulator super user privileges
Run this command,
Code:
dd if=/dev/block/mmcblk0p29 of=/storage/extSdCard/raw.dd
Wait. Leave your phone plugged into an AC Adapter, and go grab a can of pop. This command will take a looong time. Couple hours to a day.
Once the command is finished running, shutdown your phone.
Remove the SDCard, and connect it to a computer
Download TestDisk
Open PhotoRec
Select the SDCard and press enter
Use the first option of "Unknown"
Then press "Other"
Select the Directory to backup the files to
Profit
'
How it works:
By dd'ing the internal memory to a file on the SDCard, you're doing a raw copy of the data.
Once the data is copied onto the SDCard, PhotoRec will scan the SDCard for deleted data, doing so will scan the raw file for photos. Not just photos, all files can be recovered using this method.
This method works on all rootable phones, provided you can figure out where the dev block for the internal memory is.
Hope you guys get your files recovered. I know I did
Click to expand...
Click to collapse
So i've followed your guidelines to a 'T' with a brand new 64g (huge, i know) Sd card, but the command line responds with, "writer error: file to large". Any advice as to how to proceed?
Really appreciate your efforts on this issue, btw!
Hello Everyone,
I've been trying for more than a week now to recover data (photos, contacts, messages) from my HTC One M7 after I accidentally hit the factory reset button (was in a hurry to play squash and was fumbling around till the disaster happened!) :crying: Worse of all, I have no backups :crying::crying: My phone has no SD card, only the internal memory. It runs on Android 5.0.2 and has been rooted. I have busybox and TWRP installed on the phone. I have Android SDK and cygwin on my PC.
Initially, I tried to mount the phone's internal memory as a drive on Windows so I can do a scan of it using a data recovery tool. But I wasn't successful as MTP seems like the only option and there's no way to diable it. Even the disable MTP option inside TWRP doesn't make the drive accessible via USB! I have tried various recovery software available online but none of them can see my phone thanks to the stupid MTP!
Finally, I tried the steps on this thread precisely
http://forum.xda-developers.com/gal...de-internal-memory-data-recovery-yes-t1994705
Have managed to copy the whole memory block of the phone using
/system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0
and created a mmcblk0.raw file which I can open using Disk Internals (Linux Reader). I found only the data that currently exists on the drive after the factory reset. Tried to access the image with TestDisk (as shown here - http://www.df.lth.se/~jokke/androidfilerecovery/) and I cannot see any of my old files there too! (I'm trying the Deeper Search Option now)
I'm not sure if 'dd' command copies the disk sector-by-sector. I think any data recovery software can scan the disk image and find the old files as long as I can create a sector-by-sector image of the phone's internal drive. If not, any way to mount the internal drive as a USB drive on Windows could work too! Can anyone please help me with this?
Many thanks in advance!!!!
I am a newbie at fone hacking.
I put a new Kingston 128G SD card in my Moto E40 phone. Android (v11) offered to help me by moving my pictures to the empty SD card and freeing up internal memory. Great.
Except then the SD card died - it is not visible (doesn't mount) in the phone or in my PC - I assume that it's fried ?
Can I retrieve my deleted photos from the internal memory of Android after it has deleted them ?
And, is there any way to resurrect the SD card ?
Please and thanks for any help... Ray
SilverCraftRay said:
...
Can I retrieve my deleted photos from the internal memory of Android after it has deleted them ?
...
Click to expand...
Click to collapse
If phone is succesfully got paired with PC ( read: ADB connection ), if phone's Android got successfully rooted, if phone's internal storage where photos are stored by default isn't got encrypted and isn't got overwritten by new data, then it's theoretically possible to retrieve the deleted photos.
If I use Magisk to get root access, the tutorial says that it will wipe my data.
How would I get my files back if the rooting process wipes my data ?
Can I root my phone without losing all it's data ?
Noone needs Magisk to root a phone's Android: that's a nurse fairy tale.
To root Android all you have to do is to create a copy of SU-binary in Android's filesystem and make it executable. After that you can run all Linux commands alike
mount and dd etc.pp. as ROOT.
Example - using ADB
Code:
adb devices
adb push <LOCATION-OF-SUITABLE-SU-BINARY-ON-PC-HERE> /data/local/tmp/
adb shell "cd /data/local/tmp & chmod 2776 su"
what will 1. connect the Android device to your desktop computer and 2. upload the su binary in the Android device temporary directory always available for the user.
Thanks. adb is very powerful.
Where can I find the suitable SU-binary for this phone? Is it in another system directory on the phone? Or in the internet based on my particular phone?
Once it is pushed, will my phone tools use it automatically? It seems that su is a manual command. Or will it be found automatically since it is in the /data/local/tmp directory ?
you can't root Android 5+ like that. the only nurse fairy tale is post #4 as discussed here.
even with root access it's impossible to recover deleted files from FBE file-based encryption (which is enforced on devices shipped Android 10+)
you can try to recover files from Kingston MicroSD Card with card reader on PC
https://www.z-a-recovery.com
Wrong
FBE ( what is significantly more insecure than FDE ) was introduced with Android 7 ( read: Nougat ) in August 2016.
Having elevated rights ( AKA SU ) you can dd a phone's internal memory via ADB to PC.
BTW: The FBE key of a file is stored directly in the ext4 file-system "dentry" of each file.
"For new devices running Android 10 and higher, file-based encryption is required."
(that means if device shipped on Android 9 it may receive update to Android 10 but is still running FDE btw)
while on FDE the DEK is ciphered with TEE static master key, FBE encryption keys are ciphered with random generated DEK in TEE keystore (which is flushed on factory reset). what you see in file metadata is KEK + DEK ciphered per-file-key (hash), where KEK is ciphered with lock screen credentials.
each files metadata is deleted when file is deleted, so the key is gone forever. as of the nature of encryption, file carving methods cannot understand what's left on disk and cannot restore any deleted files.
Now imagine, FBI forensics do a full dump of disk and find a method to magically restore each single byte of inode + dentry (for one single file), still they cannot decrypt that file without DEK.
FDE is encrypted with default_password without any lock screen pin at all (even if you set pin), which is common for most devices. that allows to bypass screen lock (impossible on FBE).
further the whole block partition is decrypted at once, so undeleting files (at least on ext4) is (in theory) possible.
if userdata and crypto-footer is dumped off the phone, that backup (on PC) will even survive factory reset, it can be restored afterwards and still it's possible to decrypt (online), as the static master key is burned to chip.
if one of the encryption methods is significantly more insecure then it's clearly FDE. to overcome this one should enable Secure Start-up.
btw modern devices (like OnePlus) combine both encryption methods FBE + FDE = metadata encryption (devices launched with Android 11+)
This intellectual outpouring is all well and good, but it completely misses the point: this thread is about data recovery from internal storage memory, OP was: "Can I retrieve my deleted photos from the internal memory of Android after it has deleted them ?". The answer is YES: retrieve and restore are different operations!
FYI: I know the difference between FBE and FDE, know how to lever out both locks.
the answer is NO. Moto E40 uses metadata encryption.
jwoegerbauer said:
FYI: I know the difference between FBE and FDE, know how to lever out both locks.
Click to expand...
Click to collapse
Obviously you don't.
I pay you 100 € if you show any proof. just rm a file and try to recover on FBE encrypted flash storage.
or explain in what way retrieving of deleted files differs from restore?
wait... so you're the same guy who don't understand how SUID bit works and still claim we can place "suitable" SU-binary in /data/local/tmp?
well we shouldn't expect any proof then lol