can you get data back from a formatted and written to ext2/3 partition?
I wanted to do a factory reset (i.e. remove everything from /data except /data/media/0), but ended up formatting the partition, partly because the Materialised Theme rearranges the buttons, partly because I am a bit dumb seemingly...
After I realized what I just did, I immediately piped the whole partition onto my PC using dd and netcat. I hoped to be able to recover my photos and the /data TWRP backup I did before using photorec, but it couldn't find a single file :crying:
So does TWRP reset every bit of the partition to zero when formatting it?
Or could there be another explanation on why photorec doesn't find anything? Could there be any chance that I'll see my data again?
It's flash memory, tricks that would work on a physical hard disk WILL NOT recover any data. I am sorry but it is not possible, by ANY means, to recover your data.
It sucks I know but please take this as a learning experience on the value of off-device backups. You can upload twrp backups to Google drive directly from the phone for easy secure storage and recovery.
Also Google will sync and backup your photos if you enable it, for the future.
i did a restore last night so did a format /data /cache /system /dalvik /internal memory and did format data type yes command in TWRP. After doing the restore the phone on first boot said it was encrypting the phone!! i hadnt issued any such command so i dont know why it did that on its own. because of this one other nandroid backup on SD card has become corrupted and giving an error 255 when doing a restore. It is using the 'default' TWRP encryption password, whatever that is. I want to recover the corrupted nandroid backup. How can that be done?
Hello,
I was converting my data partition to f2fs, but forgot that this will erase my whole internal storage.
Is it possible to recover any data? At least part of the data?
I didn't boot my device yes to not overwrite deleted data.
Oneplus 3 with 3.0.2 twrp
Hello everyone!
For my bachelor's thesis, I am currently trying to correctly back up the data of a Samsung Galaxy A52 forensically. I created a first backup with adb backup. However, I would also like to create a physical one. To do this, I applied twrp-3.5.2_10-0-a52q.img.tar to the device using Odin. Afterwards I was able to extract the entire memory (~124GB) using "dd if=/dev/sda ..." and ncat. Is there a possibility to analyse this image further on? I tried it with Autopsy, but the result was not satisfactory.
Or would it be possible to create the image in another way? Rooting is no longer possible in this case, as I do not want to delete the memory.
Thank you very much for your help.
Did you dd the full sda device?
If so, you should just dd the data partition instead. Also, if your data partition is still encrypted (Stock ROM does that automatically) you won't be able to access your data.
If the data partition is mountable in TWRP and you can access files in it then you're not encrypted.
So if you then successfully dd the data partition to a .img file you should easily be able to mount it if you're running Linux on your Computer. I'm not sure whether it would be extract-able with e.g. 7zip on Windows, guess you'll have to figure that out on your own.
i did dd the full sda.
The data partition is still encrypted in the twrp. The only thing I can do for my further work is to back up everything else.
Is there a way to extract the encryption keys and decrypt the files manually? e.g. with Lime, if the keys are stored in the ram.
If your data partition is still encrypted then there's no chance of accessing your data through TWRP or even decrypting it. Only stock ROM can read your data if it's encrypted. That's why you usually format your data partition and patch the fstab after unlocking the bootloader.
thank you very much. This is enough information for my further work.