Database Info

[GUIDE] Internal Memory Data / Deleted Files Recovery

This is the same tutorial written by Wartickler at this link. Thanks for his efforts, his work is appreciated.
Here we bring minor changes to the tutorial for those of you who are facing problems accomplishing the procedures.
The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But still there is a hope.....
The Process
My phone is the Samsung Galaxy s4 (GT-I9500) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
back up the entire internal memory partition to your computer as a single, massive .RAW file,
convert the .RAW file output to a VHD,
mount the VHD as a disk in Disk Manager,
scan the attached VHD volume for files that have been deleted and recover them,
The Requirements
A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
BusyBox installed on your device,
Cygwin installed to [c:\cygwin] with pv and util-linux from the repo (at the package selection screen search for pv then util-linux and click on Default to change it to Install). Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\samsung] to put the exported .RAW file,
Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
ADB - You can use minimal adb and fastboot which is 2MB only. Attached, find the link at the bottom of this post. (make sure adb.exe is in your path. Path is in System Properties -> Advances -> Environment Variables -> System variables -> Path and add to the end: ";C:\Program Files\Android\sdk\platform-tools" or where ever you placed your adb.exe),
USB Debugging enabled on your device,
VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\samsung],
Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
A calm sense of peace and serenity that you will get your files back... :fingers-crossed:
The Work
*****Based on the number of people having trouble with this step it is now my recommendation that you choose to recover your entire memory block instead of just the data partition. In my phone's case that is mmcblk0. Please discover if yours is different.
[*]*****For identifying which block/partition you want to recover, install DiskInfo from Playstore. Open the app and click on Data (USERDATA) to see the partition name for yours. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p21
Turn on your phone
Connect the phone in ADB mode
Unlock the screen.
Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
*Remember to enter codes line-by-line. After you enter su, you have to grant permission on your mobile phone at the same time
Code:
adb forward tcp:5555 tcp:5555
adb shell
su
/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p21
Open another Cygwin terminal and enter:
Code:
adb forward tcp:5555 tcp:5555
cd /samsung
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p21.raw
[*]Depending on the size of partition it may take a while to backup.
We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\samsung], and type:
Code:
VhdTool.exe /convert mmcblk0p21.raw
Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
Select Storage-->Disk Management.
In the menu select Action-->Attach VHD.
For Location enter [c:\cygwin\samsung\mmcblk0p21.raw] and select the OK button.
Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
Select the GPT (GUID Partition Table) radio button and select the OK button.
Right-click on the Unallocated space and select New Simple Volume...
In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
?
Profit! :victory:
Good Luck :good:

help
M S T F said:
This is the same tutorial written by Wartickler at this link. Thanks for his efforts, his work is appreciated.
Here we bring minor changes to the tutorial for those of you who are facing problems accomplishing the procedures.
Good Luck :good:
Click to expand...
Click to collapse
You should add that the x86 version of Cygwin is needed, not the x64.

Do you also know that as of Android 4.3 this method doesn't work anymore?

yes
Lennyz1988 said:
Do you also know that as of Android 4.3 this method doesn't work anymore?
Click to expand...
Click to collapse
it works with 4.4.x and 5.1.1, it probably also works with 4.3. it's just an adb command after all.

Filoppi said:
it works with 4.4.x and 5.1.1, it probably also works with 4.3. it's just an adb command after all.
Click to expand...
Click to collapse
No its not that. As of Android 4.3 Google enabled Trim on our decives. That means when you delete a file its really gone. Not even a professional company can get it back.
I have tried the above methode and I could not get any data back. Thats when I started reading about Google enabling Trim and found out its impossible to get it back.
Did you try it on Android 4.3+?

try
Lennyz1988 said:
Do you also know that as of Android 4.3 this method doesn't work anymore?
Click to expand...
Click to collapse
Lennyz1988 said:
No its not that. As of Android 4.3 Google enabled Trim on our devices. That means when you delete a file its really gone. Not even a professional company can get it back.
I have tried the above method and I could not get any data back. Thats when I started reading about Google enabling Trim and found out its impossible to get it back.
Did you try it on Android 4.3+?
Click to expand...
Click to collapse
I have tried on my previous Samsung galaxy s3 (i9300) and my one plus one, both 64gb, i got at least 20% of the pictures back (.png, .jpg, ...), possibly even 50% since i had no idea how many i had on the device, some zip, most of .pdf and .doc and some other random stuff.
In both cases i did not manually delete the files from the phone, instead, i screwed up the partitions by deleting some system file, so after restarting, the SDcard/used data partition was empty.
i noticed though that even if my phone only had 500mb of free space available, the .raw partitions i extracted with this method were mostly empty, they only had about 10% of the data, so i guess some happened when android restarted, maybe yeah, some kind of trimming.
i think its worth trying anyway. just remember to not open any program or copy any file in the memory, as it would lower the chances to get anything back.

Filoppi said:
I have tried on my previous Samsung galaxy s3 (i9300) and my one plus one, both 64gb, i got at least 20% of the pictures back (.png, .jpg, ...), possibly even 50% since i had no idea how many i had on the device, some zip, most of .pdf and .doc and some other random stuff.
In both cases i did not manually delete the files from the phone, instead, i screwed up the partitions by deleting some system file, so after restarting, the SDcard/used data partition was empty.
i noticed though that even if my phone only had 500mb of free space available, the .raw partitions i extracted with this method were mostly empty, they only had about 10% of the data, so i guess some happened when android restarted, maybe yeah, some kind of trimming.
i think its worth trying anyway. just remember to not open any program or copy any file in the memory, as it would lower the chances to get anything back.
Click to expand...
Click to collapse
Yes but that's something different I think. Then you never deleted the files, they were there but not accessible.
If you look for example in the last 10 pages of the main thread, then no one is able to recover anything. Because it's simple not possible anymore. That's just how Trim works.

Lennyz1988 said:
Yes but that's something different I think. Then you never deleted the files, they were there but not accessible.
If you look for example in the last 10 pages of the main thread, then no one is able to recover anything. Because it's simple not possible anymore. That's just how Trim works.
Click to expand...
Click to collapse
I'm sorry for your loss.

Filoppi said:
I'm sorry for your loss.
Click to expand...
Click to collapse
What kind of response is that?

gonna try.

for those of u who want to know the blocks and partitions to recover the user data..
ls -l /dev/block/platform/*/by-name
after the adb shell will list them

127.0.0.1 5555 | pv -i 0.5 > mmcblk0p16.raw 0 B 0:00:02 [ 0 B/s]
i stuck at step 7 which is
0 B/s transfer rate

GoGopowerRanger said:
i stuck at step 7 which is
0 B/s transfer rate
Click to expand...
Click to collapse
That su is the most important part of command, if you miss it adb will not be able to transfer any data

M S T F said:
That su is the most important part of command, if you miss it adb will not be able to transfer any data
Click to expand...
Click to collapse
You should be honest with people. You should put in the op that it will only work on Android versions below 4.3. People are just getting false hope and wasting their time.
This method does NOT work anymore.

Lennyz1988 said:
You should be honest with people. You should put in the op that it will only work on Android versions below 4.3. People are just getting false hope and wasting their time.
This method does NOT work anymore.
Click to expand...
Click to collapse
This is not my method nor I have, my self said that 100% you will get what you have deleted. I have only brought minor changes to the tutorial for the sake of successful transfer of data to the pc.
Now if you feel responsible for the feeling of people, definitely I will appreciate if you find another way.

M S T F said:
This is not my method nor I have, my self said that 100% you will get what you have deleted. I have only brought minor changes to the tutorial for the sake of successful transfer of data to the pc.
Now if you feel responsible for the feeling of people, definitely I will appreciate if you find another way.
Click to expand...
Click to collapse
That's the thing. You just copy paste a tutorial that does not work. Why would you do that? I can imagine that you did not know that it would not work anymore. But now you do know. What do you hope to achieve? Raising your thanks meter? You give people false hope and you waste their time.
And about me finding another way....There is not even a professional company that can do it. It's impossible at the moment.

Lennyz1988 said:
That's the thing. You just copy paste a tutorial that does not work. Why would you do that? I can imagine that you did not know that it would not work anymore. But now you do know. What do you hope to achieve? Raising your thanks meter? You give people false hope and you waste their time.
And about me finding another way....There is not even a professional company that can do it. It's impossible at the moment.
Click to expand...
Click to collapse
I don't need thanks... why I should do.... it doesnt give me anything... I have got my own forum with its nice members.... if someone is in need of thanks, thats is you which is trying to show himself as a defender of others feeling, time, blah blah.......
I have recovered my file on a 4.4.2 android after a system crash which I had to reset the phone. if someone is in desperate need of something s/he will try anything and as far as I know trying this one doesn't harm anyone.
for you I have a recommendation, go and drink something cold and calm down!!!

Errr...

Awesome....the raw extraction worked on my S6 running Android 5.0.2. This time I tried it on a Mac and used Homebrew to install PV. Is there a way to get the entire image, even with the unused space?

Great
Thank you!
Worked on my sm-g900f
If you get nc/pv command not found , try this:
When you open cygwin terminal, start with this line: export PATH="/cygdrive/c/cygwin/bin";$PATH
The terminal should now know the location of them.
Same if you get that "adb: command not found" just type: export PATH=/cygdrive/c/XXXXX";$PATH
Just replace that XXXXX= to your location of adb.exe.
Hope it helps someone out of this ****

Backup the partition table and all the partitions contents of the phone without root

Hello
I am unsure if this goes here, since this is a generic question that would apply to most Android phones, I decided to put this here or on the General forum
I assume it's also not possible to do what I mention due to the way it's designed.
Let's say I have a new phone and I would like to get a backup of the whole phone partitions and partition table before doing any modification to it, using no root
Would there be a way to get the list of partitions of the phone using cat proc/partitions for example, or any other way
Then use dd to get bin/img files of the device, including bootloader, modem/radio, etc.
Use, let's say, sgdisk command to backup the partition table
I am open to other ideas I might haven't figured out yet.
In short words, I would love to dump my whole device low level data (such as EFS). I usually do this when I am already root, but maybe there's a way to do this without "tampering" the device on first place.
Thanks

Securely wiping old Android phone IMPOSSIBLE? - NO "encrypt" option

I need to wipe two Android Phones that do not have the "encrypt" option. I am selling them very soon so this is important. One phone is running stock Gingerbread, the other is using a custom rom running ICS 4.04.
I attempted a secure wipe on the ICS phone by choosing every wipe option found in TWRP (dalvik, cache,etc), then I did 2 factory resets and flashed a NEW ROM after that. Guess what..? I used the free program "DiskDigger" on my PC and I found THOUSANDS upon THOUSANDS of recoverable files. FULL pictures, not just thumbnails; I found videos, I found zip files, I found voice recordings, I found music, and more!
There is no way in hell I can sell these phones until I know they are CLEAN of my information. What pisses me off is that with iPhone, it's as simple as pressing "Erase All Content And Settings". That takes maybe 5 minutes tops and it works on iPhone's as old as the iPhone 3GS! I thought custom flashing a new rom and wiping cache in TWRP would do the trick but NOPE.
Can anyone help me?

I have an idea:
Just keep copying some random worthless files over and over till your memory fulls up
then do your erase and reset, check again with your DiskDigger again th make sure only the worthless files are retrievable instead of your personal.

Luaai said:
I have an idea:
Just keep copying some random worthless files over and over till your memory fulls up
then do your erase and reset, check again with your DiskDigger again th make sure only the worthless files are retrievable instead of your personal.
Click to expand...
Click to collapse
Is this really my only option? If so, that is sad and scary at same time, because results are still not guaranteed.
For comparison's sake, I ran Recuva which found 1,243 files. It found A LOT less, so I am glad I tried DiskDigger first. Still, Recuva showed a lot of pictures, and even if they were recoverable, you can see the FULL picture in the preview window!

umirin said:
Is this really my only option? If so, that is sad and scary at same time, because results are still not guaranteed.
For comparison's sake, I ran Recuva which found 1,243 files. It found A LOT less, so I am glad I tried DiskDigger first. Still, Recuva showed a lot of pictures, and even if they were recoverable, you can see the FULL picture in the preview window!
Click to expand...
Click to collapse
Look, when erase a file from your memory it dose not actually erase it, it just hide it from gallery or file explorer and mark it on memory allocation table to be overwritten when copy other file. So your best option is to overwrite with another worthless files. Just give it a try, you wont lose any thing.
I think you might also use any safe erase application or disk utility while connecting your phone as a USB memory. Google it.

Luaai said:
Look, when erase a file from your memory it dose not actually erase it, it just hide it from gallery or file explorer and mark it on memory allocation table to be overwritten when copy other file. So your best option is to overwrite with another worthless files. Just give it a try, you wont lose any thing.
I think you might also use any safe erase application or disk utility while connecting your phone as a USB memory. Google it.
Click to expand...
Click to collapse
I know that flash memory is different from magnetic drives. I say it's not guaranteed because who knows how many files I have to copy over and over to replace the old stuff.
What I need is a proper sanitizing app like DBAN, but for Android. I am going to check Google Play tomorrow and see if I can find one that still works on Gingerbread and ICS. I have checked these kinds of apps in the past and they were all garbage; I could still recover files easily.

An update for you... I downloaded these two apps and ran them on both phones. Here are the results...
https://play.google.com/store/apps/details?id=com.pinellascodeworks.securewipe&hl=en - Secure Wipe
https://play.google.com/store/apps/details?id=com.aiuspaktyn.secureeraser&hl=en - Secure Eraser
On the stock Gingerbread phone, 3 photos were found by DiskDigger and I was able to preview them and recover them. Recuva found 20 files, the same 3 pictures, plus some overwritten garbage. I ran both apps AGAIN and got the same results, those same 3 photos were still there, intact. So what I then did was click on the photos in Recuva and selected "Secure Overwrite Checked". I ran the scans a THIRD time, Recuva first. It found 15 different files, 11 ignored all labelled as "unrecoverable" or "very poor". Only one photo was from before was found, but there was no preview. I recovered it, but no photo program could open it, so it looks to be successfully overwritten and corrupted.
On the phone running custom ROM ICS: I ran DiskDigger and it found 0 files; Recuva found 3 files after secure wiping. One was in "poor state" and two were in "excellent" state - a .bin file and .M file. I overwrote these files in Recuva and ran the scans a second time. DiskDigger found nothing, Recuva found 3, 14 ignored, all were "unrecoverable".
So I have some peace of mind now. Before running these Secure erase programs, DiskDigger found 99% of the contents on the phone that was running custom ROM ICS. So wiping dalvik cache, other cache, multiple factory resets, and flashing a new ROM did NOTHING!
If anyone has suggestions on other recovery programs, I will do a third check to put my mind at ease.

Wow... very surprised that there is no discussion on this. Do people not care about about the security of their devices?

A question about android partitioning

Hello and sorry for bad english,
I just wanted to ask : is android does partitioning in any similar way to linux? Because they have similar kernels, can I dump emmc contents to something like a virtual hard drive then view partitions and edit them normally?
Because my family has several cheap chinese phones (mostly mtk) and they share in common this annoying system storage issue where apps could only be stored on 2gb (separated from the other 6gb of media storage(sdcard1))where there is only 0.5 gb free for you to install your applications. Custom rom flashing doesnt work, while app2sd works after some trouble, it still not stable and often problematic for the average users these phones belong to, flashing custom layouts brick phone no matter what i tried, while i tried to stay away from rooting i tried it and exposed plugins (or something) dosent even work, i gave up on this already but i would really prefer to expand my knowledge in android.

If phone's Android is rooted you always can dump contents of Android partitions.
See also here:
[GUIDE] Making Dump Files Out of Android Device Partitions - GSM-Forum
Use: The main purpose is to make a file that contains all data in android specific partition. This is really handy in case of dumping leak firmwares.
forum.gsmhosting.com

jwoegerbauer said:
If phone's Android is rooted you always can dump contents of Android partitions.
See also here:
[GUIDE] Making Dump Files Out of Android Device Partitions - GSM-Forum
Use: The main purpose is to make a file that contains all data in android specific partition. This is really handy in case of dumping leak firmwares.
forum.gsmhosting.com
Click to expand...
Click to collapse
Thank you, but can sp flash tool do the above?(does using the combo of wwr_mtk and sp flash tool achieve dumps that can be read in the same way?)

IDK

jwoegerbauer said:
IDK
Click to expand...
Click to collapse
I am away from home for some time so i cant try it, but my suggested method generates img files for everything
Also, can i in any way resize the partitions on the phone(maybe go your way then edit partitions on the pc then flash them back OR modify the sp flash tool scatter file(very unlikely to work, file size and partition size are different))or merge the internal and media partitions, or modify the rom so it stores apps in the media storage then flash it back. Any help would be appreciated.

IDK

jwoegerbauer said:
IDK
Click to expand...
Click to collapse
Ok, thanks anyway

Backup problems and questions

Hi, first of all, thank you for reading me.
I think i messed up big time.
I had Havoc OS 4.1 installed since more than a year and it was kinda messy e.g. the sim card card wasnt recognized anymore so wasnt able to make calls because i played to much in the settings.
Having some stupid but incredibly addictive games on this smartphone i decided to keep it like this and since i'm a complete n00bs and being afraid of security risk of rooting my device i never rooted it.
Big mistake.
So, recently, one games needed an update (like they all do at least once a week) and since i'm anti-google/f***book (no comment please) i nvever saved my progress in the cloud and "that" game required absolutely an update.
I installed the update from an alternative apk source and , (applause if you want and laugh), it screwed up the game.
Now the nightmare begin.
Since the device isnt rooted i made a backup of /data partition. Gone crazy and before i might explode in an uncontrollable fury and madness i used LMSA to rescue the phone. And myself, lol.
Now i have stock android and i am googled to the bone. My butt hurts. My head too.
THE (first) simple question is : how can i restore this backup because i have the error 255?
Notes and observations; logically i would say because the device is back with stock rom and doesnt have the same os/rom installed and/or the partition and whatever is not the same wich may explain the error 255.
SECOND QUESTION: can i extract/uncompress this backup and take the precious data wich is my games progresses and restore it somehow?
I know i have to give as much information possible but i dont what else to give. If you need logs, or everything else just say it nicely and i will give it to you with immense pleasure.
Oh yeah, model : XT2113-2 5g Kiev RETCA 128gb a/b type and maybe was crypted before because twrp asked me the password to make backup or else.
Thank you in advance and i really hope somebody would help, if not i just loosed 1.5 years of stupid gaming because i messed up like an idiot. (A lesson well learned, the hard way...)

Thank you so much for not answering this simple question.

Kerplunk83 said:
Thank you so much for not answering this simple question.
Click to expand...
Click to collapse
The problem is it's a Motorola with a Qualcomm chip.
If you find a solution I would love to see it.

Finally a sign of life from someone here.
Thank you sd_shadow
sd_shadow said:
The problem is it's a Motorola with a Qualcomm chip.
If you find a solution I would love to see it.
Click to expand...
Click to collapse
These precious brief and concise 2 lines of a simple answer is immensely welcomed.
Wich point me to reply that to my knowledge i interpret it as a security chip with big chances that its in relation to the knox technology.
It also point me to ask WHY, if i cant back up because of that, why/how is it possible to install a custom rom or gsi (sorry i still dont make the difference because i dont understand it) on this very protected smartphone?
That must explain why i had problems trying to root it and fail each time.
Finally i think that i should use another device for android gaming since i dont want to depend on f***book and google.
Thanks again sd_shadow. Even if it was a very simple answer it enlightens me alot.
Note: sorry for my bad english.

Kerplunk83 said:
how can i restore this backup because i have the error 255?
Click to expand...
Click to collapse
This error code means that at some point your backup of /data could not be extracted further. But for more detailed infos you must provide a recovery.log which will be generated when doing a backup of e.g. /boot.
>>> Please DO NOT copy+paste it here!! <<<​Rename it (recovery.log > recovery.log.txt) to be able to upload it within "Attach files".
Kerplunk83 said:
can i extract/uncompress this backup and take the precious data wich is my games progresses and restore it somehow?
Click to expand...
Click to collapse
Yes, use Titanium Backup (TB). Although it's very outdated it still features a restore of single apps out of a TWRP backup. Here's how you do it:
1. IMPORTANT: TB will only search for TWRP backup files on internal storage!! Use the default path created by TWRP, e.g.: /sdcard/TWRP/BACKUPS/ZY322V8K28/2023-04-08--06-53-20/
2. Install and open Titanium Backup.
3. In the upper right corner tap
MENU > scroll down to "Extract from Nandroid backup" > choose your backup folder
##############
Notes:
- Usually a TWRP backup of /data consists of several parts (data.ext4.win000, ~win001, ~win002 etc). TB requires all of them (or at least those ones with the /data/data/ path inside).
- If you are facing this error message:
Could not find any data in this TWRP backup
then your TWRP backup is compressed with gzip. To decompress it you must rename the file
data.ext4.win001 > data.ext4.win001.gz
and extract it with any archiver tool, e.g.:
- ZArchiver (Android)
- 7zip (Windows)
- Problems finding any TWRP backup data with Titanium Backup? Then please check your path!! (see above section)
Good luck!!

Thank you very much WoKoschekk i'll do it as soon i'll have the time for since i'm working today.
Thank you so much again, i'll keep you posted with logs and such.

I'm sorry i didnt gave news since, i'm not doing very well.
there's those 2 question i still have in my head;
1-With all the instructions you gave me is it worthy to continue because when i did the backup i wasnt rooted?
2- i'm sure i read many time to use Titanium Backup (wich is a paid app?) i have to be rooted or have root access.
Ultimately, how can i be rooted if there's a chip preventing me to do so?
I'll keep you posted when i'll be of better health, thank you.

Kerplunk83 said:
-With all the instructions you gave me is it worthy to continue because when i did the backup i wasnt rooted?
Click to expand...
Click to collapse
TWRP backup = *.tar archive
TB unpacks the needed app's data and nothing else. You must be rooted to have access on /data for restoring your apps. But for the backup process it doesn't matter if you were rooted. Root is part of your boot.img.
Kerplunk83 said:
2- i'm sure i read many time to use Titanium Backup (wich is a paid app?) i have to be rooted or have root access.
Click to expand...
Click to collapse
TB is for free. But a paid version unlocks additional features (not related to the TWRP restoring feature).
And yes... root is mandatory for TB. As I said before you must have r/w access on /data/*.
Kerplunk83 said:
if there's a chip preventing me to do so?
Click to expand...
Click to collapse
Which chip?? You already have root access via TWRP. Magisk is only needed in system and just a patched boot.img (custom kernel).

Get well soon!

WoKoschekk thank you for this insanely fast reply.
All those answers and infos have now a gigantic value for me, if only i knew that before.
To describe a bit more my situation i slept only few hours since 5 days, vomiting, heavy coughs and fever.
I'm sure i'm not supposed to but i will anyway, i engage myself and promise to reward you (in particular) and others for the help you're bringing me. It wont be much but very important to me.
I'll go try to get (again) some rest. Just before i go, why was there a mention about my device;
"
The problem is it's a Motorola with a Qualcomm chip.
If you find a solution I would love to see it.
"
I dont ask you (WoKoschekk) or other to explain in the most explicit and endless details of what is exactly this "chip" and all the history that goes with it cause i dont want to be a pain but just why it was mentionned. Only, why?, it has ben mentionned.
I cant wait to get better since i finally see possibilities to get back those files.
Have a nice week-end and thanks again.

@Kerplunk83 To reveal the mystery behind "the chip": Motorola released two variants (Snapdragon/Mediatek CPU) of this model. Since the CPU largely determines the system structure, building a functional TWRP for both of them is very challenging. It seems that TWRP for the SD's variant got some bugs while the MT's variant runs more smooth. Due to this fact the error 255 is caused by something that you weren't be able to fix.
Regarding your problem: To restore an app and its specific app data you need the proper permissions to write in /data/data and /data/app. For this permissions you either need TWRP or Magisk installed. TWRP seems to be unable to write in that specific directory. On the other hand you don't want to install Magisk. I'm sorry but with this setup your problem can't be fixed.
Just out of curiosity, could you provide me a recovery.log showing error 255 during the restore process?
Please DO NOT copy/paste the whole log and post it here!! Instead of this you should rename the file (recovery.log => recovery.txt) because a file called *.log isn't allowed for upload. But a *.txt file is.
Options to create a recovery.log:
1. adb pull /tmp/recovery.log
=> copies a recovery.log into your ADB/fastboot folder
2. Do a backup of sth. like "boot" because the backup process will create a recovery.log by default
3. TWRP mainscreen > advanced > create log (kernel log isn't needed here)
=> log is stored on the default storage (internal or external) that you have choosen for backups etc.