Hi
Is it possible to recover deleted images & video from an android phone: OP 5T, LineageOS, rooted, TWRP, encrypted. (I can boot into recovery where TWRP asks for a password which works).
I've looked at various methods and tried adb pull /data partition to save as file.img, but it's encrypted. Photorec can't work on that.
When I asked on a reddit thread, it was indicated that when a file is deleted, its encryption key is deleted too, so impossible to retrieve.
Any ideas, or is this a lost cause due to the phone's encryption?
Thanks
Forget it, don't waste more time with this ...
Your only option is to hope that you have not re-written over the old data and a data recovery specialist can attempt to recover lost or deleted files. But it is expensive and time-consuming.
Related
Hello! I don't speak english, sorry. But I have a trouble. Can I mount System, Data folders to my PC for recover files on it?
I execute Format Data, Format System in 4ext recovery and lose my Contacts. I know that contact's database placed in some file on System or Data partition. How to recover it?
P. S.: I have not install any firmware after formatting partitions to prevent damage my data...
Please, Help me!
You can use adb to access any files on those partitions, but as you've formatted the data partition, those files will not exist anymore.
If you could "mount" the partitions, they would now be empty. I don't think there's any way to recover the data unless you have a backup somewhere (Google account?).
If there is a way, it's not a question of mounting the partitions, but actually using data recovery techniques on the phone's internal memory.
Does anybody know if that's possible / feasible?
Edit: don't you have a nandroid backup you could restore from?
that:
http://forum.xda-developers.com/showthread.php?t=1994705
might be possible solution, or a base (direction) do dig further...
I recently have been recovering, stupidly formated drive too,
got the data back (most of it anyway )
but the tree (folder structure )
was irrevertably gone, and part of a file names as well,
so, when you calm down, after getting data back,
you realise there is still a gigantic work ahead,
with bitting through thousands of files with names like:
< _ibc.so or _ops.png >, and guessing which belongs to what....
...but, if one strongly sets ones mind on accomplishing the task,
it is possible....
Edit: the link above, is just a beginning of the journey,
oft, one has to gather bits of several tutorials and [HOW TO]`s
and that is what i also, stongly recommend to do,
its because, these things are often non official- hundred percent
novice proof hardened methods,
each of them, had worked for somebody,
but there is no guarantees- that particular method`ll work for you...
Success:good:
I can't believe what I've seen!
A few days ago I encrypted my galaxy s3 running the old 4.1.2 with this guide to avoid having to enter an alphanumeric password each time I unlock the screen. Yesterday I installed an app called "Locker" that is supposed to reboot and wipe the device after a specified number of wrong lockscreen pin attemps.
When I woke up this morning I had a nandroid on the microsd (online nandroid backup app) performed overnight plus the internal storage backed up too and I decided to try that app. After 10 wrong attemps it actually rebooted to recovery but didn't wipe anything, probably cause I'm running a custom recovery (TWRP). No bad, after reboot you are prompted to enter the alphanumeric cryptopassword (different from the lockscrenn pin) so that method would be safe, I think. After entering the cryptopassword it forced reboot again, again stating I entered 10 wrong pin previously. At this point I was stuck so I tried restoring the nandroid, rebooted but guess what?? My cryptopassword was not recognized!!! I tried another time wiping everything, included internal storage, no good. I tried restoring a previous unencrypted image, incredibly it still asks me the cryptopassword and still doesn't recognize it!!
I was stuck and didn't know what to do, I said I'll try flashing a stock rom with odin, I started downloading it but I reflashed stock recovery back for another try. Wipe data/factory reset, then reflashed TWRP restored the overnight nandroid back again and guess what???
MY DEVICE ISN'T ENCRYPTED ANYMORE!!! It only asks the lockscreen pin, but if I go to settings => Security it shows itself as unencrypted!!
Such an incredible bug, yes, you'll lose your internal storage in the process and you need a nandroid to restore the /data partition. I can't believe it!!
Probably I understand what happened. The online nandroid backup is performed after the cryptokey has been entered, so it saves the data partition unencrypted.
The proof would be making a nandroid from recovery and seeing if this trick works the same
FDE on Android 4.x is already known as vulnerably and can be decrypt by various tools (not telling the name here - and don't ask me for it). Just saying, so no matter if you use it or not if an attacker have physical access to your device it's very easy to get your stuff and the fact you use a custom recovery makes it very easy (not that a stock recovery is not affected but needs some more steps to get the tools working..).
CHEF-KOCH said:
FDE on Android 4.x is already known as vulnerably and can be decrypt by various tools (not telling the name here - and don't ask me for it). Just saying, so no matter if you use it or not if an attacker have physical access to your device it's very easy to get your stuff and the fact you use a custom recovery makes it very easy (not that a stock recovery is not affected but needs some more steps to get the tools working..).
Click to expand...
Click to collapse
With other experiences I had with PCs, if you clone a bitlocker encrypted partition online, the resulting copy will be unencrypted, if you clone it booting from a live cd the resulting copy will be encrypted as well.
What I did was backing up my phone online, so the backup was of an unencrypted system. I'm sure if I restore a nandroid made in recovery environment, it will restore an encrypted system as well
I think the only way to get around it is brute forcing it, a 128 bit key is safe as long as you don't choose a short password
I wanted to do a factory reset (i.e. remove everything from /data except /data/media/0), but ended up formatting the partition, partly because the Materialised Theme rearranges the buttons, partly because I am a bit dumb seemingly...
After I realized what I just did, I immediately piped the whole partition onto my PC using dd and netcat. I hoped to be able to recover my photos and the /data TWRP backup I did before using photorec, but it couldn't find a single file :crying:
So does TWRP reset every bit of the partition to zero when formatting it?
Or could there be another explanation on why photorec doesn't find anything? Could there be any chance that I'll see my data again?
It's flash memory, tricks that would work on a physical hard disk WILL NOT recover any data. I am sorry but it is not possible, by ANY means, to recover your data.
It sucks I know but please take this as a learning experience on the value of off-device backups. You can upload twrp backups to Google drive directly from the phone for easy secure storage and recovery.
Also Google will sync and backup your photos if you enable it, for the future.
Hello guys, I have a S8+ 955U version tmobile. I was on oreo beta and wanted to revert back to 7.0 latest which is G955USQS2BRB1. I odin the files but it caused me to format my internal memory. i lost all my photos of my newborn.
How can I get them back?
I've tried a few programs but I have to be rooted which I'm not.
I found a thread SAMPWNED to root device but I can't downfrade that far back.
Any help would be appreciated.
P.S. no i did not have an sd card in the phone, all files were saved on internal.
It's really difficult to recover photos from a formatted internal SD card. Best option, I think, would be try some other recovery apps, so see if they have access to your phone, though I don't think they will have that type of low-level access.
Another possibility might be to use ADB and if you can, pre-system/security startup, enable ADB within the phone, and then you might be able to do a recovery scan of the phone partitions.
There are a few (vague?) how to's on using ADB to enter the phone pre-system/security. Search 'sonnettie', the author of one method, and you will likely find other author off-shoots of the same type of method. If I don't stay current with a thing, I forget most of the details, but that was his original(?) method, which as I was told, came to be used by others to get into the phone pre-system startup/security. It might have been obviated by the Oreo update with a bug fix.
Did you have Samsung backup configured? If so it should have uploaded the photos and you would be able to restore them. If you don't make a backup your photos are already lost, you never know when your phone might die, be stolen or in this case get formatted. Google photos is a good alternative to keep your photos backing up.
Some people have incorrectly stated that it is possible to recover the photos after formatting internal storage. The data partition is encrypted by default and unless you are able to recover both, encryption key (it was most likely overwritten during first boot after factory reset) and the part of the partition containing the photos, you cannot get your photos back. Also, I have not seen any commercial data recovery software, which is capable of finding encryption keys and deciphering corrupted data partition.
Exactly, the phone is encrypted, not remotely possible to recover the photos scanning the memory
sergioslk said:
Exactly, the phone is encrypted, not remotely possible to recover the photos scanning the memory
Click to expand...
Click to collapse
good to know.
Thanks everyone for your input. After spending countless hours trying to root phone so I could get a data recovery program on it, I gave up. Turns out I had google photos and Samsung cloud turned on and it synced all my media. I got all my media back on my phone.
Thanks guys
@OP
i want to remind you that if you are doing like updating, flashing, modifying, always make a back up thank god samsung cloud is doing that for you., but i always make a hard copy to my sd card always you newer know right. i am happy for you that you got your data back
What the title says.
Yesterday i decided to factory reset my phone because my sim card stopped working.
I backup my files by using encryption (because i don't like people to put their noses in my personal stuff), factory reset and then restore
And here comes the big boom : Most of my files on my phone are corrupted. They have their extensions but they simply don't work. They have their file sizes normal as well.
Any possible way of getting my files back?
Please do not put any troll comments because if there is no possibility, i am going crazy as i've lost pictures and music that were dear to me.
Solved :
Once encrypted you cannot unnecrypt it.
Thank you Huawei, if you do this again i swear i will move on to Samsung or any other brand. I was so lucky that i saved my stuff manually
DO NOT ENCRYPT YOUR BACKUPS!!!!!!