Database Info

Recover datas after rooting my O+7 pro

Hi,
i had root my O+7 pro and didn't seen the warning that it's wip datas ...
is there any way to recover theme?
Thanks a lot in advance

You can try disk recovery from the play store and give it root permissions, but I can't say if it will recover anything. But to be fair, there were warnings given when unlocking the bootloader, etc about the wiping of data. So possibly a hard lesson learned

Always backup... Backup... Backup... Even if just doing an update. Since you are rooted now I would get titanium backup and do a backup before any update or flashing that u r not comfortable with and back up to Google drive or push to an OTG also back up ur sdcard files by manually moving to an OTG or use twrp to backup data to an OTG... Preferably before u set a pass code or pin securities. Hope u can recover bud.

i'll try the first solution.
in all the case i'll use a good backup solution after that. and i know, i usualy alaways backup but idn, this way my brain had decided it was useless *facepalml*

hallo dare said:
You can try disk recovery from the play store and give it root permissions, but I can't say if it will recover anything. But to be fair, there were warnings given when unlocking the bootloader, etc about the wiping of data. So possibly a hard lesson learned
Click to expand...
Click to collapse
can't find the app, sorry but do you have the link of the app you have in mind?
thanks a lot for your help in all the cases :good: :highfive:

Zeirman said:
can't find the app, sorry but do you have the link of the app you have in mind?
thanks a lot for your help in all the cases :good: :highfive:
Click to expand...
Click to collapse
https://play.google.com/store/apps/details?id=com.defianttech.diskdigger

hallo dare said:
https://play.google.com/store/apps/details?id=com.defianttech.diskdigger
Click to expand...
Click to collapse
Already tried DiskDigger pro (root allowed), and only finded some icone in JPG and PNG, a blank TIF, 16 .zip, and thousands of SQLITE files (don't know what it is)... i had guess it hadn't work
Any other idea? (and thanks a lot again for your help!)

Zeirman said:
Already tried DiskDigger pro (root allowed), and only finded some icone in JPG and PNG, a blank TIF, 16 .zip, and thousands of SQLITE files (don't know what it is)... i had guess it hadn't work
Any other idea? (and thanks a lot again for your help!)
Click to expand...
Click to collapse
Think you're out of luck.

hallo dare said:
Think you're out of luck.
Click to expand...
Click to collapse
No other idea? even through adb or a soft, even not free solution? :/

i don't understand why nothing work
i had almost writte no data since i had root, and my phone has 256Go
even by writte a little with the root process and install 3 app, i couldn't writte 256Go so... why nothing work? why realy no data is found? that's not strange? :/

Maybe you can dumb and pull your userdata partition to an .img file via adb to your pc and then use softwares like recuva to recover data on windows, i don't guaranty it will work , but it's Worth the shot, i tried it one time when i had the OPO (i changed to f2fs partition without backing up and lost everything) annnnnnnndddddd...... no i found nothing lol, but maybe you can find since it's a different type of format i guess" but worth a try

Chinaroad said:
Maybe you can dumb and pull your userdata partition to an .img file via adb to your pc and then use softwares like recuva to recover data on windows, i don't guaranty it will work , but it's Worth the shot, i tried it one time when i had the OPO (i changed to f2fs partition without backing up and lost everything) annnnnnnndddddd...... no i found nothing lol, but maybe you can find since it's a different type of format i guess" but worth a try
Click to expand...
Click to collapse
i had try this tutorial: https://howtorecover.me/data-recovery-internal-storage-android-phone-guide
but the list_of_partitions.txt file is blank, no matter if i do it from the phone or computer

Zeirman said:
i don't understand why nothing work
i had almost writte no data since i had root, and my phone has 256Go
even by writte a little with the root process and install 3 app, i couldn't writte 256Go so... why nothing work? why realy no data is found? that's not strange? :/
Click to expand...
Click to collapse
There is no data found because it is encrypted.
All phones that ship with Android 6 or higher have user data encrypted by default from first boot, without the user enabling encryption.
This is intentionally designed to protect against data recovery by an attacker.
Even if you don't use a PIN or password, Android creates a random encryption key to secure the data. When the phone is wiped the keys are deleted making it difficult to recover data without said keys.

KemikalElite said:
There is no data found because it is encrypted.
All phones that ship with Android 6 or higher have user data encrypted by default from first boot, without the user enabling encryption.
This is intentionally designed to protect against data recovery by an attacker.
Even if you don't use a PIN or password, Android creates a random encryption key to secure the data. When the phone is wiped the keys are deleted making it difficult to recover data without said keys.
Click to expand...
Click to collapse
I understand better now!
that's a good news that people can't recover datas from a second hand phone
but... does it mean it's impossible for me? 0% chances? or is there a maybe complicated but possible way?

Zeirman said:
I understand better now!
that's a good news that people can't recover datas from a second hand phone
but... does it mean it's impossible for me? 0% chances? or is there a maybe complicated but possible way?
Click to expand...
Click to collapse
Not possible. The encryption keys are protected by what is called hardware-backed encryption. The Snapdragon chip binds the keys to a specific device so the data can't just be copied to a computer and recovered. It would take a major security flaw (that hasn't already been patched) to get through this system.
It is designed to be very secure. It is also used to protect fingerprint data and Netflix DRM.

KemikalElite said:
Not possible. The encryption keys are protected by what is called hardware-backed encryption. The Snapdragon chip binds the keys to a specific device so the data can't just be copied to a computer and recovered. It would take a major security flaw (that hasn't already been patched) to get through this system.
It is designed to be very secure. It is also used to protect fingerprint data and Netflix DRM.
Click to expand...
Click to collapse
You don't give me good news but at least i know why i can't recover theme
Thanks a lot for your help!

Pixel is stuck at "Pixel is starting"

My bootloader-unlocked Google Pixel runs Android Pie and it uses file-based encryption. Both system partitions are unmodified.
In an effort to get TWRP to successfully decrypt my Pixel's encrypted data, I performed a combination of:
Renaming these files (i.e., appending .bak to their names):
Code:
/data/system/gatekeeper.password.key
/data/system/gatekeeper.pattern.key
/data/system/locksettings.db
/data/system/locksettings.db-shm
/data/system/locksettings.db-wal
Copying the files back to their original names.
Setting and removing a lock pattern/password/PIN.
Now, my Pixel does not move past the "Pixel is starting" page. I can access Settings, but I have no access to my applications and files. How do I fix this so that I can get it to move past "Pixel is starting"?

I once ran into this issue, it has something to do with fingerprint and encryption, somehow it unlocks but it won't decrypt.
The only solution I've found is to wipe the device. Since you can power on the device, I suggest you to backup what you can with adb or from twrp, and do an advanced wipe, with even "format data" enabled (warning: you lose also /sdcard files), then reflash the stock factory image from fastboot.
This should remove the corrupted lock files and set it up like new.

TENN3R said:
I once ran into this issue, it has something to do with fingerprint and encryption, somehow it unlocks but it won't decrypt.
The only solution I've found is to wipe the device. Since you can power on the device, I suggest you to backup what you can with adb or from twrp, and do an advanced wipe, with even "format data" enabled (warning: you lose also /sdcard files), then reflash the stock factory image from fastboot.
This should remove the corrupted lock files and set it up like new.
Click to expand...
Click to collapse
Hang on. Did you skim my post? I'm trying to get it to decrypt or, if the decryption is not the problem, just get past "Pixel is starting" and get to my things on it. Wiping it won't fix that!
Fingerprints are not used to decrypt the device.

Bump.

Anyone else? What could be the cause of this? Would it give an error message if it couldn't find the right files?

TENN3R said:
I once ran into this issue, it has something to do with fingerprint and encryption, somehow it unlocks but it won't decrypt.
The only solution I've found is to wipe the device. Since you can power on the device, I suggest you to backup what you can with adb or from twrp, and do an advanced wipe, with even "format data" enabled (warning: you lose also /sdcard files), then reflash the stock factory image from fastboot.
This should remove the corrupted lock files and set it up like new.
Click to expand...
Click to collapse
Are you there?

TENN3R said:
I once ran into this issue, it has something to do with fingerprint and encryption, somehow it unlocks but it won't decrypt.
The only solution I've found is to wipe the device. Since you can power on the device, I suggest you to backup what you can with adb or from twrp, and do an advanced wipe, with even "format data" enabled (warning: you lose also /sdcard files), then reflash the stock factory image from fastboot.
This should remove the corrupted lock files and set it up like new.
Click to expand...
Click to collapse
Were you able to recover your data?

Bump.

Unfortunately not. I just wiped the device, maybe there is some way but I really don't know. Wiped and setup again

Bump.

Bump.

Someone please help.

Master Melab said:
Someone please help.
Click to expand...
Click to collapse
Wipe your phone maybe.

what is wrong with you all you needed to do to decrypt in twrp is disable your lock screen security, none of this other bull**** lmao.

Please help.

SnowFuhrer said:
Wipe your phone maybe.
Click to expand...
Click to collapse
That won't achieve the desired result as I'm trying to recover my data.

sudoxd said:
what is wrong with you all you needed to do to decrypt in twrp is disable your lock screen security, none of this other bull**** lmao.
Click to expand...
Click to collapse
First, I got into this mess by trying to get that to work. Second, how is this a solution?

Master Melab said:
First, I got into this mess by trying to get that to work. Second, how is this a solution?
Click to expand...
Click to collapse
it is a solution, unless there is something wrong with your phone which is caused by an entirely different issue, to access your data in twrp all you needed to do was disable your lock screen security

Unfortunately I don't think there's a way you can do it. The issue the OP is facing is that the system is unable to decrypt your user data at all, regardless of whether or not you are in TWRP or Stock Android, Stock Recovery, etc.
Trying to read between the lines on the AOSP File-based encryption https://source.android.com/security/encryption, your data is always encrypted - regardless of whether or not you have some security set (pin, password, etc). It's just a matter of whether or not the pin etc is part of the metadata used in the decryption. When you altered the security files that stored the information, you lost the ability to decrypt (probably the files have additional information that is passed with your pin to unlock the encryption keys). Removal of the files needed to be done within the system by removing the security, not by removing the files whilst it is encrypted. (Sorry if this isn't exactly what happened, it's hard to tell the exact sequence of events from the OP, i.e. whether or not it was all done in system, and when reboots were done.)
I did something like this before, and got the same result. Sorry but you'll have to rely upon the latest Google backups you had...

NZedPred said:
Trying to read between the lines on the AOSP File-based encryption https://source.android.com/security/encryption
Click to expand...
Click to collapse
I've tried, but I am unable to follow all of it.
NZedPred said:
your data is always encrypted - regardless of whether or not you have some security set (pin, password, etc). It's just a matter of whether or not the pin etc is part of the metadata used in the decryption.
Click to expand...
Click to collapse
I'm aware of that.
NZedPred said:
When you altered the security files that stored the information, you lost the ability to decrypt (probably the files have additional information that is passed with your pin to unlock the encryption keys). Removal of the files needed to be done within the system by removing the security, not by removing the files whilst it is encrypted. (Sorry if this isn't exactly what happened, it's hard to tell the exact sequence of events from the OP, i.e. whether or not it was all done in system, and when reboots were done.)
Click to expand...
Click to collapse
The files I touched have nothing to do with decryption, only unlocking.
NZedPred said:
I did something like this before, and got the same result.
Click to expand...
Click to collapse
Could you please explain what you did?

NEED URGENT HELP recovering data from wiped phone!

I am in URGENT need of HELP!
I lost all the data in my phone due to carelessness and by not paying enough attention to what I was doing. I am hoping there are still ways to recover at least some of the lost data and I would appreciate any assistance offered.
Phone: OnePlus7, Android 10 (Oxygen OS)
What Happened:
- I updated my phone OS following this tutorial: https://forum.xda-developers.com/t/...tloader-twrp-root-with-magisk-update.3954559/ (see Section 2: Update via OTA).
- I forgot to NOT REBOOT at step 3, and therefore I could not follow with step 4
- When I rebooted in recovery, I saw a notification saying "wiping" ... and my phone rebooted as new. I lost everything saved on the phone, from contacts to images.
Now, it is obvious that data was not completely wiped, as based on the duration of the wiping process one can assume the file system was purged, so there is a possibility that (some of) the data could be recovered.
What I need:
- a way to recover the lost data, even if it implies a paid software, as long as is reliable
- a clear procedure to follow, to maximize my success rate (I assume that whatever app would be used, it may require rood access, but I don't want to jeopardize the deleted data during the rooting procedure).
! the phone had a pattern lock, so perhaps the recovered data would be encrypted. If that is the case, how can I decrypt it (assuming that I know the locking pattern)?
Thank you!

Asking for help Blu G90

Forgive if I put this in the wrong section.
Q: my father recently passed away and I'm trying to recover some data that is on his phone. I physically have his phone. Blu G90. Is there a way to bypass or disable the native pin lock?
Usb debug not enabled. Default set to charge only for pc.
Pretty sure wipe at 15 is set so can't brute force.
I have a couple of forensics applications that can see it when it goes to bootloader but then they crash as soon as I try to grab an image or mount /system.
I'm literally begging for any assistance I can get.
Thanks in advance

AntiMatter2112 said:
Forgive if I put this in the wrong section.
Q: my father recently passed away and I'm trying to recover some data that is on his phone. I physically have his phone. Blu G90. Is there a way to bypass or disable the native pin lock?
Usb debug not enabled. Default set to charge only for pc.
Pretty sure wipe at 15 is set so can't brute force.
I have a couple of forensics applications that can see it when it goes to bootloader but then they crash as soon as I try to grab an image or mount /system.
I'm literally begging for any assistance I can get.
Thanks in advance
Click to expand...
Click to collapse
Since the device is locked (bootloader locked) so the permissions to change/modifiy/copy something into phone cannot obtain the internal storage files.
Only unlocking bootloader and for it is need format phone as internal storage so the device erasing all files. The pin lock can remove with adb-fastboot commands or TWRP.
But again, with locked bootloader, without chance to have internal files.

DragonPitbull said:
Since the device is locked (bootloader locked) so the permissions to change/modifiy/copy something into phone cannot obtain the internal storage files.
Only unlocking bootloader and for it is need format phone as internal storage so the device erasing all files. The pin lock can remove with adb-fastboot commands or TWRP.
But again, with locked bootloader, without chance to have internal files.
Click to expand...
Click to collapse
thanks for the reply. i was afraid of that. even after factory reset, if i root, theres a chance at partial data recovery? or is it completely gone?

AntiMatter2112 said:
thanks for the reply. i was afraid of that. even after factory reset, if i root, theres a chance at partial data recovery? or is it completely gone?
Click to expand...
Click to collapse
You can try an official unlock. Maybe it can have some result or maybe not. Trying is the attitude.
Write Google support and try to legally show some death certificate and supporting documents over your father's phone number. Write down the situation and wait for some response from them.
The only practical way would be to try a backup of the internal partition. But it depends on your knowledge with Smart Phone Flash Tool. Also you must know how to "cut" the file in the right parts.
There would be a very small possibility of restoring the internal files with a backup of userdata or in its entirety (called ROM_1).
The next step would be to unlock the phone, install TWRP and restore the file made from userdata.
Perhaps at that point you have a 1% chance of removing the PIN and booting the device without a password.
But this should only be done if Google gives you a negative answer.
Another way is with carrier company. But I think help in nothing.
Understand that despite having a userdata file with PIN, there is encryption involved and that is what makes the whole process difficult.
I know the TWRP made for BLU G90 has active decryption. But I don't know how it will behave with a userdata file made with stock ROM.
Unfortunately there is no guarantee that files like photos, docs, etc can be in userdata as this refers to internal storage. Already userdata is in ROOT storage.
So even if there is an application or software capable of restoring files, there is also the possibility that it will not be successful or have corrupted files. This will depend on your choice and risk carrying out the process.

DragonPitbull said:
You can try an official unlock. Maybe it can have some result or maybe not. Trying is the attitude.
Write Google support and try to legally show some death certificate and supporting documents over your father's phone number. Write down the situation and wait for some response from them.
The only practical way would be to try a backup of the internal partition. But it depends on your knowledge with Smart Phone Flash Tool. Also you must know how to "cut" the file in the right parts.
There would be a very small possibility of restoring the internal files with a backup of userdata or in its entirety (called ROM_1).
The next step would be to unlock the phone, install TWRP and restore the file made from userdata.
Perhaps at that point you have a 1% chance of removing the PIN and booting the device without a password.
But this should only be done if Google gives you a negative answer.
Another way is with carrier company. But I think help in nothing.
Understand that despite having a userdata file with PIN, there is encryption involved and that is what makes the whole process difficult.
I know the TWRP made for BLU G90 has active decryption. But I don't know how it will behave with a userdata file made with stock ROM.
Unfortunately there is no guarantee that files like photos, docs, etc can be in userdata as this refers to internal storage. Already userdata is in ROOT storage.
So even if there is an application or software capable of restoring files, there is also the possibility that it will not be successful or have corrupted files. This will depend on your choice and risk carrying out the process.
Click to expand...
Click to collapse
Thanks for the reply. Google was pretty useless. They told me to contact Blu and Blu said to contact Google. I successfully hard reset and root. Went through setup to try a restore from his drive backup and it wanted the unlock pin in order to restore. Google was again quite useless. Since this is a matter if his estate i served Google with a notice of preservation on the backup, since it expires pretty soon. I'm going to try next to roll back to an older version, before the unlock pin requirement to restore Google backup. Grabbed a cellebrite image earlier so I can mess around with it later tonight. I'm hoping that because of the unlock requirement that the pin file is still there after reset.

is it possible to us majisk without factory resetting?

i'm trying to recover data (mostly folders in my internal storage such as screenshots, screecaptures, etc.) but the programs i am using need my phone to be rooted. My phone runs on android 9 and needs it's bootloder to be unlocked but i need to know if there is a way to d this without factory resetting which may overwrite the lost data which i cannot recover when doing so.

A Factoy Reset only wipes files what means it deletes their entries in Android's inode-table , it doesn't overwrite them. The diskspace previously allocated by the now wiped files becomes orphaned, thus can get reused.

Use ADB pull to extract user-data files where a rooted Android isn't needed.
See also here:
How to Download Files to the Computer with ADB Pull - KrispiTech
You can actually copy and download files from your Android smartphone to the PC using some simple ADB Pull commands as long as you enabled USB Debugging.
krispitech.com

so i can still recover files i deleted prior to a factory reset needed to unlock my oem?

please reply

To recover deleted files Android must be rooted and a special commercial forensic software must be used. GIYF ...

xXx yYy said:
To recover deleted files Android must be rooted and a special commercial forensic software must be used. GIYF ...
Click to expand...
Click to collapse
do you know any that i should use?

Your device is encrypted with FDE. the same answer applies. One can't recover data after factory reset. encryption key is gone forever, and so is your data.
edit: if you haven't done factory reset yet, device might still encrypted with same crypto-footer. this leads you to hypothetical option to obtain temporary root shell and pull decrypted block partition /dev/block/dm-0 (or whatever)
assuming you found vulnerability/exploit and managed to get raw dump, still your chances to recover deleted files are low, because of the way android flash translation controller handles eMMC flash storage.

aIecxs said:
Your device is encrypted with FDE. the same answer applies. One can't recover data after factory reset. encryption key is gone forever, and so is your data.
edit: if you haven't done factory reset yet, device might still encrypted with same crypto-footer. this leads you to hypothetical option to obtain temporary root shell and pull decrypted block partition /dev/block/dm-0 (or whatever)
assuming you found vulnerability/exploit and managed to get raw dump, still your chances to recover deleted files are low, because of the way android handles eMMC flash storage.
Click to expand...
Click to collapse
if only i have discovered these posts sooner...
so those recovery apps are useless?

most of the data recovery tools / one-click-rooting apps aren't working anymore since marshmallow. there are however some companies like cellebrite claiming they can still hack. maybe they got somehow access to Samsungs OEM signing keys idk

Don't know if I got you right, you haven't factory reset your device, yet?
This app might help you to find existing files and thumbnails of deleted files. To my understanding it won't undelete anything but some users claim different. It will search for hidden trash can in gallery, maybe you are lucky...
FindMyPhoto – Recover Photos o - Apps on Google Play
A truely free app to recover deleted photos on Android devices.
play.google.com

aIecxs said:
Don't know if I got you right, you haven't factory reset your device, yet?
This app might help you to find existing files and thumbnails of deleted files. To my understanding it won't undelete anything but some users claim different. It will search for hidden trash can in gallery, maybe you are lucky...
FindMyPhoto – Recover Photos o - Apps on Google Play
A truely free app to recover deleted photos on Android devices.
play.google.com
Click to expand...
Click to collapse
i did factory reset...
i should probably give up and move on, shouldn't i?
the app looks really promising, but it has alot of one star reviews

just another useless app..
better root your device, factory reset again and disable encryption. this way you are prepared next time

aIecxs said:
just another useless app..
better root your device, factory reset again and disable encryption. this way you are prepared next time
Click to expand...
Click to collapse
have you actually used the app, seen the reviews, or both?

Best Cellebrite Alternatives & Competitors
Compare the best Cellebrite alternatives in 2023. Explore user reviews, ratings, and pricing of alternatives and competitors to Cellebrite.
sourceforge.net
Besides Cellebrite is there an alternative
Besides Cellebrite is there an alternative to capturing data from a cell phone on the physical side (ie deleted items)? In addition to bypassing the ...
www.forensicfocus.com
https://www.reddit.com/r/computerforensics/comments/a1j43j
These links have cellebrite alternatives and one person said that they use odin + twrp. I hope some of them are freeware/ have free trials. Can someone help me verify if these are legit?

moutsu said:
have you actually used the app, seen the reviews, or both?
Click to expand...
Click to collapse
another user suggested this app. but only helpful to find existing pictures in trash can. read full discussion here
https://android.stackexchange.com/q/231132

moutsu said:
These links have cellebrite alternatives and one person said that they use odin + twrp. I hope some of them are freeware/ have free trials. Can someone help me verify if these are legit?
Click to expand...
Click to collapse
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com

aIecxs said:
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com
Click to expand...
Click to collapse
aww
to let anyone know about how i ended up into this rabbit hole of recovery apps and finding out about xda, heres a backstory: some, if not all, of the folders were deleted in the storage/emulated/0 file directory after possibly me deleting them after they have popped up in an app that accessed your files. this is why i've been asking questions and doing research on how to recover them. i had to root my device according to the answers, but i didnt want to unlock the bootloader but i had to unlock it eventually. i really regret doing that. if this happens to someone in the future, i would ask anyone if it is possible to recover the files in storage/emulated/0 after they were deleted.

aIecxs said:
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com
Click to expand...
Click to collapse
so there IS a way? if it's not impossible then it is possible!

x=1
Kds ld fhud xnt dwzlokd.