NEED URGENT HELP recovering data from wiped phone! - OnePlus 7 Questions & Answers

I am in URGENT need of HELP!
I lost all the data in my phone due to carelessness and by not paying enough attention to what I was doing. I am hoping there are still ways to recover at least some of the lost data and I would appreciate any assistance offered.
Phone: OnePlus7, Android 10 (Oxygen OS)
What Happened:
- I updated my phone OS following this tutorial: https://forum.xda-developers.com/t/...tloader-twrp-root-with-magisk-update.3954559/ (see Section 2: Update via OTA).
- I forgot to NOT REBOOT at step 3, and therefore I could not follow with step 4
- When I rebooted in recovery, I saw a notification saying "wiping" ... and my phone rebooted as new. I lost everything saved on the phone, from contacts to images.
Now, it is obvious that data was not completely wiped, as based on the duration of the wiping process one can assume the file system was purged, so there is a possibility that (some of) the data could be recovered.
What I need:
- a way to recover the lost data, even if it implies a paid software, as long as is reliable
- a clear procedure to follow, to maximize my success rate (I assume that whatever app would be used, it may require rood access, but I don't want to jeopardize the deleted data during the rooting procedure).
! the phone had a pattern lock, so perhaps the recovered data would be encrypted. If that is the case, how can I decrypt it (assuming that I know the locking pattern)?
Thank you!

Related

[Q] How do I gain root without wiping my data on stock 4.1.2

Yesterday I spend the whole day trying to gain root on my Nexus S while preserving my precious data on the phone.
Ho do I gain root without wiping my data?
Is there currently a way at all?
All I need is to be pointed into the right direction.
I'd be really thankful for helpful responses.
Thanks for reading
I have:
a functional ADB connection
a locked Bootloader
a stock Recovery
a Desktop Backup Password set which is unknown to me
I tried gaining root with:
SRS One Click Root for Android
Root_with_Restore_by_Bin4ry_v26
I ruled out:
Unlocking the Bootloader
doing a Factory reset
creating a backup via desktop backup since I have set an unknown password
Samsung Nexus S (GT-I9023) :: herring 4.1.2/JZ054K :: Radio I9020XXKI1 :: Bootloader I9020XXLC2
An unknown password on ur phone?
What data u talking about?
Copy it all to ur computer before rooting then copy it back. Backup ur SMS with "SMS backup +" then restore it.
Vs Nexus S4G using tapatalk2
You can't.
OK, so I was writing this big reply telling how I don't think that rooting makes you lose you data and all. Then I googled it for a bit (as it's been a long time since I rooted mine, I could be wrong) and found out I was indeed wrong
Thing is, when you unlock your bootloader, as a safety precaution, your data partition is erased. As far as I can tell, there's nothing you can do about that.
OK, so you don't want to unlock the bootloader, you want to simply gain root access, right? So, it should be doable. I don't believe that just flashing a recovery will erase your data partition (i think).
There's this guide I found that should help you. Just remember to read the whole thing through before following it
completeandroid.wordpress.com/2011/01/31/complete-guide-to-rooting-the-nexus-s
Now, about that desktop backup password. Initially, I don't think that should be a problem. After you have root access you can use something like Titanium Backup to backup all your data and then unlocking the bootloader (if you want to do that). I don't have my desktop backup password set, so I'm not sure this would work.
Hope I have helped.
Cheers!
The simple answer is that you cant... i tried a lot, but failed
If you want all your precious data restored in its original position, get Titanium Backup and backup everything... Restore it after getting rooted...
Sent from my Nexus S using xda premium
Partially resolved
Thanks for all your replies.
Luckily I was able to brute force guess the forgotten Desktop Backup Password. So for me the topic is resolved since I now was able to make a full Desktop Backup. Unlock the Bootloader and restore the backup.
I did set the password at a time where I got ICS and wanted to give it a try just to realize that the full backup is more designed for development purposes then for the end user. At that point I just abort that mini project and forgot about it. That's how I forgot the testing password I initially set when I got ICS.
For me this issue is resolved for someone else having the same issue probably not.
So at the time writing I don't know of any root exploit in existence that works for a stock build 4.1.2/JZ054K
--
hehe @gmantovani I also stumbled about that blog post, followed it's instructions just to realize that it didn't apply for my case.
You can use Go Backup to backup everything you don't want to lose, that is in the SD Card. But it's usually SMS and Call-logs so I'd personally use SMS-Backup/Restore and CallLogs-Backup/Restore apps to do it. Contacts will be synced with your Gmail account and photos will be stored in your SD card.

SUCCESS : ROOT + Encryption.

Hi guys,
I want to share my experiences about having ROOT + Encryption. This case of mine may pose as example for anyone who want to root their phones while want to have their device encrypted at the same time.
My phone is Samsung Note 3, Stock Lollipop 5.0, rooted with KingRoot 4.85 (kingroot.net). I think you can also have your phones to be rooted regardless of rooting mechanism. I picked KingRoot because it was the one successfully rooted my device without installing any custom recoveries, which is really IMPORTANT if we want to apply device encryption..:fingers-crossed:
Previously I posted question here : http://forum.xda-developers.com/showpost.php?p=66643426&postcount=4538
No answer there so I keep tinkering and googling then found this thread : http://forum.xda-developers.com/z3-...-device-encryption-root-t3338691/post66615860
On my case, my Note 3 was not encrypted (also have unencrypted external 32GB MicroSD), then I rooted it successully via exploit. I then started device encryption without any problems. I also have frozen Knox and many other Samsung bloatwares before started the encryption.
The conclusion is, as long as your rooting process didnt involve custom recoveries then you are good to go with device encryption, whether root first later encrypt or encrypt first then root later.
I am not expert and hoping this small info can help other non experts who want to taste rooting privileges while preserving device encryption.
Cheers
I am using CM12.1 (Android 5.1.1) custom ROM, IdleKernel 7.1.0 custom kernel, TWRP 3.0.2 custom recovery and my encryption works just fine.
What's performance like with encryption?
I haven't noticed any difference with my day-to-day usage.
Hello,
good for you, I got my Galaxy Note 3 yesterday. I went first of all to have it encrypted and it's not booting after the encryption It's not rooted, basically I launched the encryption as one of the first operations :-/
Hi,
very interesting thread. I rooted as well my S7 but installed TWRP - so the bootloader is unlocked and it seems, that an encryption doesnt make much sense.
If I got you right, an installation of a cfw with the described procedure isnt possible.
Is there a way, if you have already installed a custom recovery to get a S7 encrypted and rooted?
Today I tried 3 different strategies for getting my phone encrypted - none of them worked
Each time the phone reboots within 2-3 minutes and nothing gets encrypted. @tefole - I was only successful with the ROM of the polish guy (artas...), his ROM is excellent, but I can't see the SD card when I connect the phone to my laptop, so it's again a NO-GO
darkman088 said:
Today I tried 3 different strategies for getting my phone encrypted - none of them worked
Each time the phone reboots within 2-3 minutes and nothing gets encrypted. @tefole - I was only successful with the ROM of the polish guy (artas...), his ROM is excellent, but I can't see the SD card when I connect the phone to my laptop, so it's again a NO-GO
Click to expand...
Click to collapse
Till now, i were also not able to get it run.
In other threads i see people, which were successfull - with restrictions.
I am shocked a bit, why this "encryption on rooted phones" topic is not treated very much, because you dont get much information.
It seems, or this means that most of the guys are dont care with their data, if they lost their phone.
Imagine, you lose phone or get it stolen and you dont figure it out immediately:
whatsapp/threema chat history and the corresponding meda (in my case: 5 years old)
contacts
all emails!
photos / DCIM
social media account: instagram, twitter, etc..
google drive
downloads and documents
connection to my homenetwork (openvpn)
An encrypted phone is a important but imho is rooting a must-have too, to get your phone debloated and for using xposed, adaway, xprivacy, etc...
I guess, a conflict of interests.
@Galactus described me a way here.
From what I understand is the way:
-flash stock firmware (stock firmware is delivered with already encrypted partitions)
-root with CF-autoroot
-you can flash TWRP as well
-restore or flashing of any CFW is not possible with TWRP
quite a lot compromises - if you want to encrypt ur phone.
I renounce on features and comfort, before i risk to share my life with a thief
tefole said:
Till now, i were also not able to get it run.
In other threads i see people, which were successfull - with restrictions.
I am shocked a bit, why this "encryption on rooted phones" topic is not treated very much, because you dont get much information.
It seems, or this means that most of the guys are dont care with their data, if they lost their phone.
Imagine, you lose phone or get it stolen and you dont figure it out immediately:
whatsapp/threema chat history and the corresponding meda (in my case: 5 years old)
contacts
all emails!
photos / DCIM
social media account: instagram, twitter, etc..
google drive
downloads and documents
connection to my homenetwork (openvpn)
An encrypted phone is a important but imho is rooting a must-have too, to get your phone debloated and for using xposed, adaway, xprivacy, etc...
I guess, a conflict of interests.
@Galactus described me a way here.
From what I understand is the way:
-flash stock firmware (stock firmware is delivered with already encrypted partitions)
-root with CF-autoroot
-you can flash TWRP as well
-restore or flashing of any CFW is not possible with TWRP
quite a lot compromises - if you want to encrypt ur phone.
I renounce on features and comfort, before i risk to share my life with a thief
Click to expand...
Click to collapse
Yes, I am very worried about the situation you describe, and I don't even have half of the things you describe! And I'm so glad that you are using Threema. I couldn't convince any of my friends to install it - they use WhatsApp and Viber and when I mention privacy, they always keep saying - I have no secrets, I have nothing to hide and nothing to be afraid of. No comment...
And about encryption - the funny thing is, that I couldn't encrypt it with the stock ROM, this is why I rooted it - to be able to install a custom ROM. and now it's such a hassle to get it encrypted when it's been rooted! What an irony!
So I think that the only option for me is to use the Artas ROM, as it can encrypt the phone itself. But with it, I don't see the SD card when I connect the phone to my laptop - it means that I can copy a lot of data only to the phone and will then need to move it to the SD card - quite uncomfortable.
And also it's not possible to encrypt the SD card - but let's say, I'll put only mp3s and movies on it, so nothing really secret. Then another possibility is to return the phone and get another one, but I don't really have an alternative - maybe LG G4, but I think that the Note is much sweeter...
Or get an iPhone out of frustration
OK, so that's it ? No help, no support, no suggestions ?
I had expected more interest in this...
Hello, sorry for late replies on my thread as if my replies would even help though.
I still have the Galaxy Note 3 (Rooted) with Stock 5.0 Lollipop as described on this post. Please be reminded I was not using any custom recoveries.
Recently this phone came into this situation :
Previously working external 32 GB Samsung Evo Micro-SD is no longer capable to be used in encrypted form. First I though failed cards but then tried with other cards came with same problems, they all can be used in "unencrypted form".. so weird. If I try to encrypt it it says "Unable To Mount SD Card" which is weird since it can be mounted and used properly while in unencrypted form. This situation happened while internal device still in encrypted form. I then tried to decrypt all of them, both external and internal storage, weirdly it is succeed. At this point then my device really naked, non of storages are in encrypted form.
I then tried again to encrypt my internal storage (device encryption) with external SD card detached from device, with more than 10 failed trials resulted only as regular restarts then at 11th or so trials it then came into proper reboot and properly start encrypting my device (external storage was detached before process).
Right now the device is only have internal storage encrypted with external storage UN-encrypted. Maybe some days in future I will try again to re-encrypt the external sd card but so far internal storage encypted is enough while stays rooted. For anyone of you outthere who face regular restart without result when trying to encrypt via settings, dont give up! They tend to do stupid restarts but at some point they will sober and do proper encryption process. I was successfull re-encrypting internal storage after 11th or so reboots. Going with some cool drinks and listen to jazzy music before doing encyption helped much to the soul.

cannot use adb to solve continuous reboot - device offline

I have oneplus one came from chineese retailer already rooted and with adware. always meant to reflash with straight CM or with a version of AOSP, but ended up use adb (which I have for development, though I am NOT experienced in using adb, flashing rom or what ever only programming) to disable a number of apps and it seemed to be stable.
More recently I had a phone crash following the crash of an app that I think is the CM app launcher, something begining with t, trebuchet?, i dont recall. Since then the phone keeps rebooting and I cannot seems to use adb, the device is either not present or offline.
I can boot to cyanogen recovery which offers:
- reboot system now
- apply update
- apply from adb
- choose from internal storage
- wipe data/factory reset
- wipe cache partition
- wipe media
If I select apply from adb then the device is nolonger offline but in sideline mode, but I don't think this is what I want.
I never liked CM and I had always thought that I might try to flash with a version of AOSP if possible and I wondered if now was the time. I thought TWRP might be useful for this and the first step to installing this was:
C:\...\Downloads>adb reboot bootloader
but I get
error: closed
I briefly see the debugging notification before the phone reboots but in adb it is always not present or offline.
How do I get to the point of either solving my repeating reboot at least or preferably installing a version of AOSP that would be compatible with OnePlus One, preferably without destrying data. I think the data is in a different partition or something but I have forgotten the little I learnt about this a few years ago.
I would be so grateful of some help and learning, right now to all intents and purposes I have a nice looking brick.
hardya said:
I have oneplus one came from chineese retailer already rooted and with adware. always meant to reflash with straight CM or with a version of AOSP, but ended up use adb (which I have for development, though I am NOT experienced in using adb, flashing rom or what ever only programming) to disable a number of apps and it seemed to be stable.
More recently I had a phone crash following the crash of an app that I think is the CM app launcher, something begining with t, trebuchet?, i dont recall. Since then the phone keeps rebooting and I cannot seems to use adb, the device is either not present or offline.
I can boot to cyanogen recovery which offers:
- reboot system now
- apply update
- apply from adb
- choose from internal storage
- wipe data/factory reset
- wipe cache partition
- wipe media
If I select apply from adb then the device is nolonger offline but in sideline mode, but I don't think this is what I want.
I never liked CM and I had always thought that I might try to flash with a version of AOSP if possible and I wondered if now was the time. I thought TWRP might be useful for this and the first step to installing this was:
C:\...\Downloads>adb reboot bootloader
but I get
error: closed
I briefly see the debugging notification before the phone reboots but in adb it is always not present or offline.
How do I get to the point of either solving my repeating reboot at least or preferably installing a version of AOSP that would be compatible with OnePlus One, preferably without destrying data. I think the data is in a different partition or something but I have forgotten the little I learnt about this a few years ago.
I would be so grateful of some help and learning, right now to all intents and purposes I have a nice looking brick.
Click to expand...
Click to collapse
Did you try factory reset?
Thank you so much for your the suggestion, I appreciate it.
Not yet I haven't. I'm not familiar with the CM Recovery Software and the option is entitled "wipe data/factory reset". Do you happen to know if this means bother or either and if selecting this explains more and gives options before proceeding. Key is I want to avoid wiping data if possible because while most is sync'd offline some is recent and not or not for particular reasons.
If there's a choice then will "factory reset" leave personal data alone? Do you know, will the factory reset likely be to version/adaptation of CM put on by rooting retailer PLUS anoying/mal/ad/ware apps put on by rooting retailer.
If this is my only option then I will go ahead and do it and take the hit.
If following this, it is possible to install a stable Android 7.n.n AOSP only that will support the hardware and leave data intact (ONLY LEAVE DATA IF POSSIBLE) I would be very grateful for a clear and complete script to achieve this. I was a professional developer for 20 years, now semi-retired, so I know what I know and what I don't know in terms of foundational knowledge, taking care etc etc, but I am very inexperienced in flashing phones and using ADB except the fact the eclipse/android studio uses it.
I used a windows script to install fastboot if that is any help (though the script did show some errors it still said "All Done!" at the end. Tried to C&P the errors but failed). I can also try to install TWRP (or what ever) if that's any help.
Many thanks would really appreciate your help in my getting my OnePlus One working and stable again.
Andrew.
hardya said:
Thank you so much for your the suggestion, I appreciate it.
Not yet I haven't. I'm not familiar with the CM Recovery Software and the option is entitled "wipe data/factory reset". Do you happen to know if this means bother or either and if selecting this explains more and gives options before proceeding. Key is I want to avoid wiping data if possible because while most is sync'd offline some is recent and not or not for particular reasons.
If there's a choice then will "factory reset" leave personal data alone? Do you know, will the factory reset likely be to version/adaptation of CM put on by rooting retailer PLUS anoying/mal/ad/ware apps put on by rooting retailer.
If this is my only option then I will go ahead and do it and take the hit.
If following this, it is possible to install a stable Android 7.n.n AOSP only that will support the hardware and leave data intact (ONLY LEAVE DATA IF POSSIBLE) I would be very grateful for a clear and complete script to achieve this. I was a professional developer for 20 years, now semi-retired, so I know what I know and what I don't know in terms of foundational knowledge, taking care etc etc, but I am very inexperienced in flashing phones and using ADB except the fact the eclipse/android studio uses it.
I used a windows script to install fastboot if that is any help (though the script did show some errors it still said "All Done!" at the end. Tried to C&P the errors but failed). I can also try to install TWRP (or what ever) if that's any help.
Many thanks would really appreciate your help in my getting my OnePlus One working and stable again.
Andrew.
Click to expand...
Click to collapse
Okay,since you want to flash Aosp N,leave that factory reset thing.
https://forum.xda-developers.com/showthread.php?t=2788632
This thread should be enough atm.Everything has been explained,and it's just simple copy paste,so,even if you're unfamiliar with adb,you should be able to do just fine.
Just follow,install adb/fastboot drivers,unlock bootloader,and flash twrp.
Now,unlocking bootloader will format internal storage,which means everything....but,a simple adb command should be able to back everything up into your pc.
Ensure your adb/fastboot drivers are already installed,and using adb devices in cmd shows your connected device id,before below process!
adb backup -apk -shared -all -f C:\Users\NAME\backup.ab
Where "NAME" is the name of your Windows user name.
On the device, a new screen should appear. If you want to encrypt the backup, enter a password -- otherwise, tap Back up my data. The backup will begin, and you'll find the backup file in the folder declared in the backup command.
Depending on how much data your device holds, this process can take quite some time.
The restoration process is simple. Connect the device to be restored and (from the same location you issued the backup command) enter the command:
adb restore C:\Users\NAME\backup.ab
Where NAME is the name of the same Windows user from the backup process.
Again, depending on how much data is on the backup, the restore process can take some time.
Click to expand...
Click to collapse
When you're done doing all of this,just follow any rom's thread instructions to flash that rom.
Btw,you're on Cos13.1.x,yes?
So sorry for not replying to say thank you sooner, I have been busy with family issues.
Thank you so much for your response, I really appreciate it. I shall take a look at this soon and try to get regular android N on the phone soon. Thank you.
I'm just starting to read and work through this. Just to clarify, re my original post, is the fact that my phone is continually rebooting and that adb shows the device as offline a problem? Will I still be able to use adb to backup the phone contents? Do I need any special understanding to do that?
I finally came back to this and flashed a new rom carbon rom. I only noticed afterwards that there is very little support for this rom and I've had some issues.
If you think the issues are in some way generic and you have come accross them before you may have some ideas:
- there is no built in task manager and third party ones do not seem to cover the apps I am interested in. Any ideas why there is no built in task manager anymore like there used to be and how one might be able to turn it back on?
- the camera does not work and the open camera I installed instead has some image faults (or misunderstood feature). Big line down the middle of the image.
Any ideas.

Asking for help Blu G90

Forgive if I put this in the wrong section.
Q: my father recently passed away and I'm trying to recover some data that is on his phone. I physically have his phone. Blu G90. Is there a way to bypass or disable the native pin lock?
Usb debug not enabled. Default set to charge only for pc.
Pretty sure wipe at 15 is set so can't brute force.
I have a couple of forensics applications that can see it when it goes to bootloader but then they crash as soon as I try to grab an image or mount /system.
I'm literally begging for any assistance I can get.
Thanks in advance
AntiMatter2112 said:
Forgive if I put this in the wrong section.
Q: my father recently passed away and I'm trying to recover some data that is on his phone. I physically have his phone. Blu G90. Is there a way to bypass or disable the native pin lock?
Usb debug not enabled. Default set to charge only for pc.
Pretty sure wipe at 15 is set so can't brute force.
I have a couple of forensics applications that can see it when it goes to bootloader but then they crash as soon as I try to grab an image or mount /system.
I'm literally begging for any assistance I can get.
Thanks in advance
Click to expand...
Click to collapse
Since the device is locked (bootloader locked) so the permissions to change/modifiy/copy something into phone cannot obtain the internal storage files.
Only unlocking bootloader and for it is need format phone as internal storage so the device erasing all files. The pin lock can remove with adb-fastboot commands or TWRP.
But again, with locked bootloader, without chance to have internal files.
DragonPitbull said:
Since the device is locked (bootloader locked) so the permissions to change/modifiy/copy something into phone cannot obtain the internal storage files.
Only unlocking bootloader and for it is need format phone as internal storage so the device erasing all files. The pin lock can remove with adb-fastboot commands or TWRP.
But again, with locked bootloader, without chance to have internal files.
Click to expand...
Click to collapse
thanks for the reply. i was afraid of that. even after factory reset, if i root, theres a chance at partial data recovery? or is it completely gone?
AntiMatter2112 said:
thanks for the reply. i was afraid of that. even after factory reset, if i root, theres a chance at partial data recovery? or is it completely gone?
Click to expand...
Click to collapse
You can try an official unlock. Maybe it can have some result or maybe not. Trying is the attitude.
Write Google support and try to legally show some death certificate and supporting documents over your father's phone number. Write down the situation and wait for some response from them.
The only practical way would be to try a backup of the internal partition. But it depends on your knowledge with Smart Phone Flash Tool. Also you must know how to "cut" the file in the right parts.
There would be a very small possibility of restoring the internal files with a backup of userdata or in its entirety (called ROM_1).
The next step would be to unlock the phone, install TWRP and restore the file made from userdata.
Perhaps at that point you have a 1% chance of removing the PIN and booting the device without a password.
But this should only be done if Google gives you a negative answer.
Another way is with carrier company. But I think help in nothing.
Understand that despite having a userdata file with PIN, there is encryption involved and that is what makes the whole process difficult.
I know the TWRP made for BLU G90 has active decryption. But I don't know how it will behave with a userdata file made with stock ROM.
Unfortunately there is no guarantee that files like photos, docs, etc can be in userdata as this refers to internal storage. Already userdata is in ROOT storage.
So even if there is an application or software capable of restoring files, there is also the possibility that it will not be successful or have corrupted files. This will depend on your choice and risk carrying out the process.
DragonPitbull said:
You can try an official unlock. Maybe it can have some result or maybe not. Trying is the attitude.
Write Google support and try to legally show some death certificate and supporting documents over your father's phone number. Write down the situation and wait for some response from them.
The only practical way would be to try a backup of the internal partition. But it depends on your knowledge with Smart Phone Flash Tool. Also you must know how to "cut" the file in the right parts.
There would be a very small possibility of restoring the internal files with a backup of userdata or in its entirety (called ROM_1).
The next step would be to unlock the phone, install TWRP and restore the file made from userdata.
Perhaps at that point you have a 1% chance of removing the PIN and booting the device without a password.
But this should only be done if Google gives you a negative answer.
Another way is with carrier company. But I think help in nothing.
Understand that despite having a userdata file with PIN, there is encryption involved and that is what makes the whole process difficult.
I know the TWRP made for BLU G90 has active decryption. But I don't know how it will behave with a userdata file made with stock ROM.
Unfortunately there is no guarantee that files like photos, docs, etc can be in userdata as this refers to internal storage. Already userdata is in ROOT storage.
So even if there is an application or software capable of restoring files, there is also the possibility that it will not be successful or have corrupted files. This will depend on your choice and risk carrying out the process.
Click to expand...
Click to collapse
Thanks for the reply. Google was pretty useless. They told me to contact Blu and Blu said to contact Google. I successfully hard reset and root. Went through setup to try a restore from his drive backup and it wanted the unlock pin in order to restore. Google was again quite useless. Since this is a matter if his estate i served Google with a notice of preservation on the backup, since it expires pretty soon. I'm going to try next to roll back to an older version, before the unlock pin requirement to restore Google backup. Grabbed a cellebrite image earlier so I can mess around with it later tonight. I'm hoping that because of the unlock requirement that the pin file is still there after reset.

is it possible to us majisk without factory resetting?

i'm trying to recover data (mostly folders in my internal storage such as screenshots, screecaptures, etc.) but the programs i am using need my phone to be rooted. My phone runs on android 9 and needs it's bootloder to be unlocked but i need to know if there is a way to d this without factory resetting which may overwrite the lost data which i cannot recover when doing so.
A Factoy Reset only wipes files what means it deletes their entries in Android's inode-table , it doesn't overwrite them. The diskspace previously allocated by the now wiped files becomes orphaned, thus can get reused.
Use ADB pull to extract user-data files where a rooted Android isn't needed.
See also here:
How to Download Files to the Computer with ADB Pull - KrispiTech
You can actually copy and download files from your Android smartphone to the PC using some simple ADB Pull commands as long as you enabled USB Debugging.
krispitech.com
so i can still recover files i deleted prior to a factory reset needed to unlock my oem?
please reply
To recover deleted files Android must be rooted and a special commercial forensic software must be used. GIYF ...
xXx yYy said:
To recover deleted files Android must be rooted and a special commercial forensic software must be used. GIYF ...
Click to expand...
Click to collapse
do you know any that i should use?
Your device is encrypted with FDE. the same answer applies. One can't recover data after factory reset. encryption key is gone forever, and so is your data.
edit: if you haven't done factory reset yet, device might still encrypted with same crypto-footer. this leads you to hypothetical option to obtain temporary root shell and pull decrypted block partition /dev/block/dm-0 (or whatever)
assuming you found vulnerability/exploit and managed to get raw dump, still your chances to recover deleted files are low, because of the way android flash translation controller handles eMMC flash storage.
aIecxs said:
Your device is encrypted with FDE. the same answer applies. One can't recover data after factory reset. encryption key is gone forever, and so is your data.
edit: if you haven't done factory reset yet, device might still encrypted with same crypto-footer. this leads you to hypothetical option to obtain temporary root shell and pull decrypted block partition /dev/block/dm-0 (or whatever)
assuming you found vulnerability/exploit and managed to get raw dump, still your chances to recover deleted files are low, because of the way android handles eMMC flash storage.
Click to expand...
Click to collapse
if only i have discovered these posts sooner...
so those recovery apps are useless?
most of the data recovery tools / one-click-rooting apps aren't working anymore since marshmallow. there are however some companies like cellebrite claiming they can still hack. maybe they got somehow access to Samsungs OEM signing keys idk
Don't know if I got you right, you haven't factory reset your device, yet?
This app might help you to find existing files and thumbnails of deleted files. To my understanding it won't undelete anything but some users claim different. It will search for hidden trash can in gallery, maybe you are lucky...
FindMyPhoto – Recover Photos o - Apps on Google Play
A truely free app to recover deleted photos on Android devices.
play.google.com
aIecxs said:
Don't know if I got you right, you haven't factory reset your device, yet?
This app might help you to find existing files and thumbnails of deleted files. To my understanding it won't undelete anything but some users claim different. It will search for hidden trash can in gallery, maybe you are lucky...
FindMyPhoto – Recover Photos o - Apps on Google Play
A truely free app to recover deleted photos on Android devices.
play.google.com
Click to expand...
Click to collapse
i did factory reset...
i should probably give up and move on, shouldn't i?
the app looks really promising, but it has alot of one star reviews
just another useless app..
better root your device, factory reset again and disable encryption. this way you are prepared next time
aIecxs said:
just another useless app..
better root your device, factory reset again and disable encryption. this way you are prepared next time
Click to expand...
Click to collapse
have you actually used the app, seen the reviews, or both?
Best Cellebrite Alternatives & Competitors
Compare the best Cellebrite alternatives in 2023. Explore user reviews, ratings, and pricing of alternatives and competitors to Cellebrite.
sourceforge.net
Besides Cellebrite is there an alternative
Besides Cellebrite is there an alternative to capturing data from a cell phone on the physical side (ie deleted items)? In addition to bypassing the ...
www.forensicfocus.com
https://www.reddit.com/r/computerforensics/comments/a1j43j
These links have cellebrite alternatives and one person said that they use odin + twrp. I hope some of them are freeware/ have free trials. Can someone help me verify if these are legit?
moutsu said:
have you actually used the app, seen the reviews, or both?
Click to expand...
Click to collapse
another user suggested this app. but only helpful to find existing pictures in trash can. read full discussion here
https://android.stackexchange.com/q/231132
moutsu said:
These links have cellebrite alternatives and one person said that they use odin + twrp. I hope some of them are freeware/ have free trials. Can someone help me verify if these are legit?
Click to expand...
Click to collapse
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com
aIecxs said:
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com
Click to expand...
Click to collapse
aww
to let anyone know about how i ended up into this rabbit hole of recovery apps and finding out about xda, heres a backstory: some, if not all, of the folders were deleted in the storage/emulated/0 file directory after possibly me deleting them after they have popped up in an app that accessed your files. this is why i've been asking questions and doing research on how to recover them. i had to root my device according to the answers, but i didnt want to unlock the bootloader but i had to unlock it eventually. i really regret doing that. if this happens to someone in the future, i would ask anyone if it is possible to recover the files in storage/emulated/0 after they were deleted.
aIecxs said:
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com
Click to expand...
Click to collapse
so there IS a way? if it's not impossible then it is possible!
x=1
Kds ld fhud xnt dwzlokd.

Categories

Resources