Database Info

Signatures in Android boot - making a copy of a factory-signed ROM

Hello,
I am not sure if this is the right subforum to post in but I figured that since my question is related to the Android boot process and signatures, it kind of touches security and this seemed as the best-fitting subforum (my apologies if it is not). Just to begin with, I am no computer noob. I write C code for a living and I know how cryptographic signatures work. However, I am completely unfamiliar with the Android ecosystem, so I may have some noob questions there...
Basically, I would like to know why it is not possible to take a bit-by-bit backup of an official signed ROM from the eMMC of an Android 9+ MediaTek-based device and then restore it later. Could someone please explain or point me to documentation about the technical mechanism that prevents this?
Background:
I bought a Gigaset GS290 smartphone with the intention of installing the /e/ operating system on it. However, since it is currently in mint condition, I was thinking it might be a good idea to first make a backup of the original factory firmware, in case I ever need to go back, especially since there is no official signed ROM available for this device.
I read that since this device has a MediaTek chipset, I can use the SPFlash tool to read/write arbitrary memory off/onto it. Therefore, I would think that I should be able to take a bit-by-bit image of the eMMC in its original factory state and then later take that image and write it back in order to restore the original software, including verified boot. However, according to [1], it is not possible since Android 9. My question is why. How does the operating system come into play?
Also, [2] mentions that the SPFlash tool is only able to create a backup that contains an unsigned image. How is that even possible if whatever is in the eMMC is signed?
I realize that there is a chain of trust originating probably in some TPM on the chipset that verifies the bootloader and the bootloader then verifies the system. I understand that by flashing an unlocked bootloader and modified system I break that chain of trust, BUT by restoring the original contents of the eMMC, I should be able to fully restore that chain, right? I mean the phone is a deterministic device that has a state (== the contents of its memories). Which part of the device's state will I not be able to restore using the aforementioned method? The only mechanism that I can think of is that the TPM would have to erase its keys when it is unable to verify a bootloader, which does not seem probable to me. Could someone please refute or confirm this?
Best Regards
Mike
[1] https://android.stackexchange.com/questions/220584/smart-phone-flash-tool-readback-emmc-user-backup
[2] https://forum.hovatek.com/thread-26015-post-155676.html#pid155676

Asking for help Blu G90

Forgive if I put this in the wrong section.
Q: my father recently passed away and I'm trying to recover some data that is on his phone. I physically have his phone. Blu G90. Is there a way to bypass or disable the native pin lock?
Usb debug not enabled. Default set to charge only for pc.
Pretty sure wipe at 15 is set so can't brute force.
I have a couple of forensics applications that can see it when it goes to bootloader but then they crash as soon as I try to grab an image or mount /system.
I'm literally begging for any assistance I can get.
Thanks in advance

AntiMatter2112 said:
Forgive if I put this in the wrong section.
Q: my father recently passed away and I'm trying to recover some data that is on his phone. I physically have his phone. Blu G90. Is there a way to bypass or disable the native pin lock?
Usb debug not enabled. Default set to charge only for pc.
Pretty sure wipe at 15 is set so can't brute force.
I have a couple of forensics applications that can see it when it goes to bootloader but then they crash as soon as I try to grab an image or mount /system.
I'm literally begging for any assistance I can get.
Thanks in advance
Click to expand...
Click to collapse
Since the device is locked (bootloader locked) so the permissions to change/modifiy/copy something into phone cannot obtain the internal storage files.
Only unlocking bootloader and for it is need format phone as internal storage so the device erasing all files. The pin lock can remove with adb-fastboot commands or TWRP.
But again, with locked bootloader, without chance to have internal files.

DragonPitbull said:
Since the device is locked (bootloader locked) so the permissions to change/modifiy/copy something into phone cannot obtain the internal storage files.
Only unlocking bootloader and for it is need format phone as internal storage so the device erasing all files. The pin lock can remove with adb-fastboot commands or TWRP.
But again, with locked bootloader, without chance to have internal files.
Click to expand...
Click to collapse
thanks for the reply. i was afraid of that. even after factory reset, if i root, theres a chance at partial data recovery? or is it completely gone?

AntiMatter2112 said:
thanks for the reply. i was afraid of that. even after factory reset, if i root, theres a chance at partial data recovery? or is it completely gone?
Click to expand...
Click to collapse
You can try an official unlock. Maybe it can have some result or maybe not. Trying is the attitude.
Write Google support and try to legally show some death certificate and supporting documents over your father's phone number. Write down the situation and wait for some response from them.
The only practical way would be to try a backup of the internal partition. But it depends on your knowledge with Smart Phone Flash Tool. Also you must know how to "cut" the file in the right parts.
There would be a very small possibility of restoring the internal files with a backup of userdata or in its entirety (called ROM_1).
The next step would be to unlock the phone, install TWRP and restore the file made from userdata.
Perhaps at that point you have a 1% chance of removing the PIN and booting the device without a password.
But this should only be done if Google gives you a negative answer.
Another way is with carrier company. But I think help in nothing.
Understand that despite having a userdata file with PIN, there is encryption involved and that is what makes the whole process difficult.
I know the TWRP made for BLU G90 has active decryption. But I don't know how it will behave with a userdata file made with stock ROM.
Unfortunately there is no guarantee that files like photos, docs, etc can be in userdata as this refers to internal storage. Already userdata is in ROOT storage.
So even if there is an application or software capable of restoring files, there is also the possibility that it will not be successful or have corrupted files. This will depend on your choice and risk carrying out the process.

DragonPitbull said:
You can try an official unlock. Maybe it can have some result or maybe not. Trying is the attitude.
Write Google support and try to legally show some death certificate and supporting documents over your father's phone number. Write down the situation and wait for some response from them.
The only practical way would be to try a backup of the internal partition. But it depends on your knowledge with Smart Phone Flash Tool. Also you must know how to "cut" the file in the right parts.
There would be a very small possibility of restoring the internal files with a backup of userdata or in its entirety (called ROM_1).
The next step would be to unlock the phone, install TWRP and restore the file made from userdata.
Perhaps at that point you have a 1% chance of removing the PIN and booting the device without a password.
But this should only be done if Google gives you a negative answer.
Another way is with carrier company. But I think help in nothing.
Understand that despite having a userdata file with PIN, there is encryption involved and that is what makes the whole process difficult.
I know the TWRP made for BLU G90 has active decryption. But I don't know how it will behave with a userdata file made with stock ROM.
Unfortunately there is no guarantee that files like photos, docs, etc can be in userdata as this refers to internal storage. Already userdata is in ROOT storage.
So even if there is an application or software capable of restoring files, there is also the possibility that it will not be successful or have corrupted files. This will depend on your choice and risk carrying out the process.
Click to expand...
Click to collapse
Thanks for the reply. Google was pretty useless. They told me to contact Blu and Blu said to contact Google. I successfully hard reset and root. Went through setup to try a restore from his drive backup and it wanted the unlock pin in order to restore. Google was again quite useless. Since this is a matter if his estate i served Google with a notice of preservation on the backup, since it expires pretty soon. I'm going to try next to roll back to an older version, before the unlock pin requirement to restore Google backup. Grabbed a cellebrite image earlier so I can mess around with it later tonight. I'm hoping that because of the unlock requirement that the pin file is still there after reset.

is it possible to us majisk without factory resetting?

i'm trying to recover data (mostly folders in my internal storage such as screenshots, screecaptures, etc.) but the programs i am using need my phone to be rooted. My phone runs on android 9 and needs it's bootloder to be unlocked but i need to know if there is a way to d this without factory resetting which may overwrite the lost data which i cannot recover when doing so.

A Factoy Reset only wipes files what means it deletes their entries in Android's inode-table , it doesn't overwrite them. The diskspace previously allocated by the now wiped files becomes orphaned, thus can get reused.

Use ADB pull to extract user-data files where a rooted Android isn't needed.
See also here:
How to Download Files to the Computer with ADB Pull - KrispiTech
You can actually copy and download files from your Android smartphone to the PC using some simple ADB Pull commands as long as you enabled USB Debugging.
krispitech.com

so i can still recover files i deleted prior to a factory reset needed to unlock my oem?

please reply

To recover deleted files Android must be rooted and a special commercial forensic software must be used. GIYF ...

xXx yYy said:
To recover deleted files Android must be rooted and a special commercial forensic software must be used. GIYF ...
Click to expand...
Click to collapse
do you know any that i should use?

Your device is encrypted with FDE. the same answer applies. One can't recover data after factory reset. encryption key is gone forever, and so is your data.
edit: if you haven't done factory reset yet, device might still encrypted with same crypto-footer. this leads you to hypothetical option to obtain temporary root shell and pull decrypted block partition /dev/block/dm-0 (or whatever)
assuming you found vulnerability/exploit and managed to get raw dump, still your chances to recover deleted files are low, because of the way android flash translation controller handles eMMC flash storage.

aIecxs said:
Your device is encrypted with FDE. the same answer applies. One can't recover data after factory reset. encryption key is gone forever, and so is your data.
edit: if you haven't done factory reset yet, device might still encrypted with same crypto-footer. this leads you to hypothetical option to obtain temporary root shell and pull decrypted block partition /dev/block/dm-0 (or whatever)
assuming you found vulnerability/exploit and managed to get raw dump, still your chances to recover deleted files are low, because of the way android handles eMMC flash storage.
Click to expand...
Click to collapse
if only i have discovered these posts sooner...
so those recovery apps are useless?

most of the data recovery tools / one-click-rooting apps aren't working anymore since marshmallow. there are however some companies like cellebrite claiming they can still hack. maybe they got somehow access to Samsungs OEM signing keys idk

Don't know if I got you right, you haven't factory reset your device, yet?
This app might help you to find existing files and thumbnails of deleted files. To my understanding it won't undelete anything but some users claim different. It will search for hidden trash can in gallery, maybe you are lucky...
FindMyPhoto – Recover Photos o - Apps on Google Play
A truely free app to recover deleted photos on Android devices.
play.google.com

aIecxs said:
Don't know if I got you right, you haven't factory reset your device, yet?
This app might help you to find existing files and thumbnails of deleted files. To my understanding it won't undelete anything but some users claim different. It will search for hidden trash can in gallery, maybe you are lucky...
FindMyPhoto – Recover Photos o - Apps on Google Play
A truely free app to recover deleted photos on Android devices.
play.google.com
Click to expand...
Click to collapse
i did factory reset...
i should probably give up and move on, shouldn't i?
the app looks really promising, but it has alot of one star reviews

just another useless app..
better root your device, factory reset again and disable encryption. this way you are prepared next time

aIecxs said:
just another useless app..
better root your device, factory reset again and disable encryption. this way you are prepared next time
Click to expand...
Click to collapse
have you actually used the app, seen the reviews, or both?

Best Cellebrite Alternatives & Competitors
Compare the best Cellebrite alternatives in 2023. Explore user reviews, ratings, and pricing of alternatives and competitors to Cellebrite.
sourceforge.net
Besides Cellebrite is there an alternative
Besides Cellebrite is there an alternative to capturing data from a cell phone on the physical side (ie deleted items)? In addition to bypassing the ...
www.forensicfocus.com
https://www.reddit.com/r/computerforensics/comments/a1j43j
These links have cellebrite alternatives and one person said that they use odin + twrp. I hope some of them are freeware/ have free trials. Can someone help me verify if these are legit?

moutsu said:
have you actually used the app, seen the reviews, or both?
Click to expand...
Click to collapse
another user suggested this app. but only helpful to find existing pictures in trash can. read full discussion here
https://android.stackexchange.com/q/231132

moutsu said:
These links have cellebrite alternatives and one person said that they use odin + twrp. I hope some of them are freeware/ have free trials. Can someone help me verify if these are legit?
Click to expand...
Click to collapse
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com

aIecxs said:
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com
Click to expand...
Click to collapse
aww
to let anyone know about how i ended up into this rabbit hole of recovery apps and finding out about xda, heres a backstory: some, if not all, of the folders were deleted in the storage/emulated/0 file directory after possibly me deleting them after they have popped up in an app that accessed your files. this is why i've been asking questions and doing research on how to recover them. i had to root my device according to the answers, but i didnt want to unlock the bootloader but i had to unlock it eventually. i really regret doing that. if this happens to someone in the future, i would ask anyone if it is possible to recover the files in storage/emulated/0 after they were deleted.

aIecxs said:
once you factory reset device NOTHING can help you - it's gone. well, technically spoken that's not true, but next to impossible. forensic lab might partially recover old crypto-footer from the lower emmc firmware, and spend some years bruteforcing missing bytes.
TWRP is completely useless for samsung encryption, samsung encryption not supported, yet (although it's possible just a matter of time)
consider: all these tools might still work on quite a few older devices, from the days where exploiting was possible or encryption wasn't hardware-backed. They mainly offer breaking into lock screen and maybe can recover deleted files. They can by-pass locked bootloader, let android do it's work and pull (decrypted) partition image from root shell (for further analysis). They can break into TEE and extract encryption master key for chip-off bruteforce. But none of these tools ever claimed to recover data after factory reset. except for scams (like wondershare Dr. Fone) I don't know anything about iPhone I am talking about Android only.
conclusion:
- if a company offers you JTAG or chip-off they are trying to scam you.
- recovery of deleted files is not the same as recovery after factory reset. encryption is the showstopper here.
Demystifying Android Physical Acquisition
Numerous vendors advertise many types of solutions for extracting evidence from Android devices. The companies claim to support tens of thousands of models, creating the impression that most (if not all) Android devices can be successfully acquired using one method or another. On the other side o
blog.elcomsoft.com
Click to expand...
Click to collapse
so there IS a way? if it's not impossible then it is possible!

x=1
Kds ld fhud xnt dwzlokd.

How to acquire an Android physical disk image?

Hi there,
As the title suggests, I would like to acquire a physical disk image of my Samsung Galaxy A01 which I will be using Autopsy to analyze. My research has lead me to believe that in order to do so one must first root the device. So my questions are:
1. If I root the device will all the data I am attempting to analyze be deleted/erased in the process?
2. Does anyone know of a good guide for Android disk image acquisition?
I have been following the DFIRScience channel on youtube but in his video on disk image acquisition he uses KingoRoot which according to this rooting guide (last section at bottom of article) by XDA is bad practice.
This rooting guide from guidetoroot.com mentions that during the rooting process all the data will be erased, and this is where my confusion has come from. If that is true it would seem counter productive to the purpose of acquiring a disk image. My operating system is Win 8.1 Pro by the way.
I would very much appreciate it if someone could help me out with this.

Dune_Rat said:
Hi there,
As the title suggests, I would like to acquire a physical disk image of my Samsung Galaxy A01 which I will be using Autopsy to analyze. My research has lead me to believe that in order to do so one must first root the device. So my questions are:
1. If I root the device will all the data I am attempting to analyze be deleted/erased in the process?
2. Does anyone know of a good guide for Android disk image acquisition?
I have been following the DFIRScience channel on youtube but in his video on disk image acquisition he uses KingoRoot which according to this rooting guide (last section at bottom of article) by XDA is bad practice.
This rooting guide from guidetoroot.com mentions that during the rooting process all the data will be erased, and this is where my confusion has come from. If that is true it would seem counter productive to the purpose of acquiring a disk image. My operating system is Win 8.1 Pro by the way.
I would very much appreciate it if someone could help me out with this.
Click to expand...
Click to collapse
The guides that discuss the device being wiped during the root process only applies to devices that have locked bootloader. These devices have to unlock the bootloader before they can modify the device, the device gets wiped by default as part of the process of unlocking the bootloader.

Droidriven said:
The guides that discuss the device being wiped during the root process only applies to devices that have locked bootloader. These devices have to unlock the bootloader before they can modify the device, the device gets wiped by default as part of the process of unlocking the bootloader.
Click to expand...
Click to collapse
Ah I see, thanks very much, Droidriven. Do you perhaps know of any good recent guides for android disk image acquisition?

Dune_Rat said:
Ah I see, thanks very much, Droidriven. Do you perhaps know of any good recent guides for android disk image acquisition?
Click to expand...
Click to collapse
The term "disk image" does not apply to android. What do you mean by "disk image"?
If you are asking if there is a way to backup the operating system on your device and all other data on your device before you attempt to root your device, there is no way to do that without either root or TWRP custom recovery. You don't need both, but, you do need at least one of them. There are ways to backup user data using adb without root but you can't backup the operating system or anything else in the system partition.
Without root, you, as the user, can only backup user installed apps and their corresponding app data/settings, user data stored in internal storage and device settings.
If the operating system gets corrupted during your rooting attempt, you will have to flash your device's stock firmware via Odin then restore any data that you backed up.

Droidriven said:
The term "disk image" does not apply to android. What do you mean by "disk image"?
If you are asking if there is a way to backup the operating system on your device and all other data on your device before you attempt to root your device, there is no way to do that without either root or TWRP custom recovery. You don't need both, but, you do need at least one of them. There are ways to backup user data using adb without root but you can't backup the operating system or anything else in the system partition.
Without root, you, as the user, can only backup user installed apps and their corresponding app data/settings, user data stored in internal storage and device settings.
If the operating system gets corrupted during your rooting attempt, you will have to flash your device's stock firmware via Odin then restore any data that you backed up.
Click to expand...
Click to collapse
Thanks for the info. By "disk image" I was referring to the "cloning" of the device once rooted. I would like to test out some digital forensic software like Autopsy with a real world device like my A01 by acquiring/making a physical disk image of it.
That's the term they use in digital forensics...there's physical and then there's logical disk images. Logical disk images are used more for surface analysis and has limitations on what can be done with it and does not appear to need rooting. Physical disk images on the other hand provide full unrestricted access to all files. Well, that's my understanding of it, anyway.
I would like to try using FTK Imager for this purpose (acquiring a disk image) but it's not detecting the device so I'm also hoping that will be sorted out once the phone has been rooted.

Dune_Rat said:
Thanks for the info. By "disk image" I was referring to the "cloning" of the device once rooted. I would like to test out some digital forensic software like Autopsy with a real world device like my A01 by acquiring/making a physical disk image of it.
That's the term they use in digital forensics...there's physical and then there's logical disk images. Logical disk images are used more for surface analysis and has limitations on what can be done with it and does not appear to need rooting. Physical disk images on the other hand provide full unrestricted access to all files. Well, that's my understanding of it, anyway.
I would like to try using FTK Imager for this purpose (acquiring a disk image) but it's not detecting the device so I'm also hoping that will be sorted out once the phone has been rooted.
Click to expand...
Click to collapse
You're looking for what we call a "nandroid backup", a copy of all data that is stored on the device. Typically, creating a nandroid backup requires either rooting the device then using adb commands to pull a nandroid backup or it requires installing a custom recovery such as TWRP that has an option to create a nandroid backup from within recovery mode.
Your device probably doesn't have a custom recovery/TWRP. Custom recoveries are built specific to the model number that they are to be installed on, there is no such thing as a universal custom recovery that can be used on all android devices. If no developer has chosen to build a version of TWRP for your specific model number then your device can't use TWRP unless you manage to build it for yourself.
These days, most Samsung devices cannot be rooted because they have bootloaders that cannot be unlocked. The only hope of rooting a Samsung device that has a locked bootloader that cannot be unlocked is to find an android app or PC program that has an exploit that your device is vulnerable to. But, these kinds of apps and programs have not been able to root devices since somewhere around the time that android Lollipop or Marshmallow was released, they are no longer able to root today's devices.
You may have to choose another device to experiment with. Preferably one that already has a custom recovery available for that specific model number or has known working root method for that specific model number.
What is your A01's specific model number? That is what will determine wgat is or isn't available for your device and what you can and can't do with it.

Thanks so much for the thorough responses, Droidriven. This has cleared everything up for me. The specific model number of my phone is SM-A015F/DS.

Dune_Rat said:
Thanks so much for the thorough responses, Droidriven. This has cleared everything up for me. The specific model number of my phone is SM-A015F/DS.
Click to expand...
Click to collapse
Apparently, there is a version of TWRP for your model number, but, from what I've been reading, you need to be on android 11 in order to unlock your bootloader then install TWRP. Once you have TWRP installed, you can use it to create a nandroid backup by using the Backup option in TWRP. In your case, you probably want to backup absolutely everything that can be backed up, therefore, when you choose the Backup option in TWRP, on the next screen you'll see a list of partitions to backup, select the partitions you want to backup then initiate the backup by sliding the slider at the bottom. Then you'll have to find the correct tools to extract the data from the backup, it can be tricky because of the type of file that TWRP creates.
unofficial twrp 3.5.2 Root Samsung Galaxy A01 SM-A015F
Download unofficial twrp 3.5.2 Root Samsung Galaxy A01 SM-A015F, user who own Galaxy A01 can root it by following the below Instructions
unofficialtwrp.com

Awesome, this looks promising...I'll take a look at it. Thanks again for all the info, Droidriven, you've been a star.

Android data recovery - Root required or no?

Hey guys,
I have a query on recovering data from Android phone's internal storage.
The phone is J7 Pro (SM-J730GM) and I am trying to recover some deleted data from the phone.
I have tried UltData for Android but it only lists the data that is already present on the phone...it does not show the deleted data.
I tried DroidKit and it clearly states that 'Root required for Deep Scan'. Only quick scan available which is same as UltData (lists only data that is already present).
I did some research and it seems that without root, it is not possible to recover lost/deleted data.
I was wondering if anyone here has some knowledge/experience about this topic?
Is there any reliable tool out there that can recover data WITHOUT root? Or using commands via ADB shell ?
Root is the last thing I want to go for as it may sometimes brick the device.

{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

jwoegerbauer said:
Click to expand...
Click to collapse

mru007 said:
Root is the last thing I want to go for as it may sometimes brick the device.
Click to expand...
Click to collapse
First of all, unlocking the bootloader will erase all data of your internal storage.
To recover deleted files you investigate your storage to find file signatures.
When deleting a file only the corresponding entry in the partition table will be erased. But the data of your file itself remains physically on your storage until it gets overwritten.
Best practice for that is to create an image file of your entire storage. But at least you will need full access to your data partition '/userdata'. That requires an unlocked bootloader to install a custom recovery like TWRP and/or root. Both give you full access to /userdata at all levels, increasing your chances of successfully recovering your files.
Factory reset: Files that have been deleted by a factory reset are due to encryption of internal storage (file based) almost unrecoverable. Wiping all data also deletes the decryption key stored in the system. During the next boot process /userdata (which is empty) gets encrypted again but with different keys.
It's not mandatory to have root permissions but you must have an unlocked bootloader.

An USB connection to your PC is not suitable to recover deleted files. Both, ADB and storage access, won't open your file system directly. There's at least one system service on your phone that manages the data transfer, e.g. MTP.

WoKoschekk said:
First of all, unlocking the bootloader will erase all data of your internal storage.
To recover deleted files you investigate your storage to find file signatures.
When deleting a file only the corresponding entry in the partition table will be erased. But the data of your file itself remains physically on your storage until it gets overwritten.
Best practice for that is to create an image file of your entire storage. But at least you will need full access to your data partition '/userdata'. That requires an unlocked bootloader to install a custom recovery like TWRP and/or root. Both give you full access to /userdata at all levels, increasing your chances of successfully recovering your files.
Factory reset: Files that have been deleted by a factory reset are due to encryption of internal storage (file based) almost unrecoverable. Wiping all data also deletes the decryption key stored in the system. During the next boot process /userdata (which is empty) gets encrypted again but with different keys.
It's not mandatory to have root permissions but you must have an unlocked bootloader.
Click to expand...
Click to collapse
Thanks for the detail info!
When I go to Developer options -> OEM unlocking, it says here "Bootloader already unlocked." So it's a good thing for proceeding further I suppose.
For TWRP installation, I checked the method but it says 'unlocking bootloader will Wipe Data.
Does installing TWRP automatically attempts to unlock bootloader (and hence the risk of wipe data?)
Here is the blog that list steps to root with TWRP and gives a bright red warning -
Root Samsung Galaxy J7 Pro SM-J730GM and Install TWRP Recovery
Easy tutorial to Root Samsung Galaxy J7 Pro SM-J730GM in easy steps. For rooting, you have to flash TWRP Recovery first through the guide.
www.androidweblog.com
So my q. is -
If I just install TWRP, does it pose a risk to automatically wipe data?
Any options in TWRP itself to recover deleted data?
The other way is to root the device using Magisk app which does not require TWRP, but a bit complicated process.
This is the blog I came across to root J7 Pro without TWRP -
Root Samsung Galaxy J7 Pro SM-J730GM/G using Magisk Without TWRP
Easy tutorial to Root Samsung Galaxy J7 Pro SM-J730GM/G in easy steps using Magisk. For rooting, you we have described Magisk method, without installing TWRP.
www.androidweblog.com
Hope TWRP method does not Wipe Data & rooting method does not brick the device.
Even if we follow all the steps properly, there is always a little chance that it may brick the device

WoKoschekk said:
An USB connection to your PC is not suitable to recover deleted files. Both, ADB and storage access, won't open your file system directly. There's at least one system service on your phone that manages the data transfer, e.g. MTP.
Click to expand...
Click to collapse
Interesting.
I also tried mounting the phone internal storage as a 'disk drive' (with letter) using a tool called MTPdrive but then no data recovery software recognizes it as a 'valid' partition. It says invalid.

mru007 said:
If I just install TWRP, does it pose a risk to automatically wipe data?
Click to expand...
Click to collapse
If your bootloader is already unlocked, it is very good news for you. TWRP doesn't unlock bootloader or wipe your data.
mru007 said:
Any options in TWRP itself to recover deleted data?
Click to expand...
Click to collapse
No.
Follow the steps properly with the correct files to root your device.
Once successfully rooted, install a good data recovery app and try to recover your lost files.
Important thing to remember is that the more files you copy or install (i.e. the more changes you make to your file system), the lesser chance there will be to recover data because the system tries to use the space occupied by deleted data to write new files to it.
So do one thing at a time and make as little changes as possible to root your phone and install the data recovery app. Do your research first to find out the best options.
All the best!

mru007 said:
Any options in TWRP itself to recover deleted data?
Click to expand...
Click to collapse
No, but you could do the following when TWRP runs:
1. Download the ADB/Fastboot tools here.
2. Extract the downloaded ZIP to C:\ and open the new created folder C:\platform-tools. You should see single files like adb.exe or fastboot.exe
3. In the address bar of your Explorer windows type cmd and hit Enter.
4. Connect the phone in TWRP mode via USB to your desktop PC and execute
Code:
adb devices
which should give you a output like this:
Code:
C:\platform-tools>adb devices
* daemon not running; starting now at tcp:5037
* daemon started successfully
List of devices attached
<SERIAL_NO> recovery
If any errors then tell us!
5. Execute
Code:
adb pull /dev/block/by-name/userdata
This pulls an image of your data partition right into the current folder C:\platform-tools.
But be aware!! The data image is as big as your total internal storage!
So, make sure there is enough free space on your storage.
If you successfully pulled the image, then I will explain you how to rescue the deleted data on it.

Even if you can recover files... the file and folder structure is lost forever. Jpegs will have no exif data, no time stamp etc. It will be a real mess.
The most you can do then is search for file type, for example jpegs. A sea of juxtaposed jpegs; every bloody jpeg on the drive.
You learned a valuable lesson on how fragile digital data can be, the hard way. Why didn't you use a SD card as the data drive? All critical data should be redundantly backup at least twice in addition to the SD card.

blackhawk said:
Even if you can recover files... the file and folder structure is lost forever. Jpegs will have no exif data, no time stamp etc. It will be a real mess.
The most you can do then is search for file type, for example jpegs. A sea of juxtaposed jpegs; every bloody jpeg on the drive.
You learned a valuable lesson on how fragile digital data can be, the hard way. Why didn't you use a SD card as the data drive? All critical data should be redundantly backup at least twice in addition to the SD card.
Click to expand...
Click to collapse
I learnt my lesson the hard way in 2013 or 2014, but I was eventually lucky after spending 2 sleepless nights. Lost all files on my laptop hard disc by passing a command that I didn't fully understand. After 2 days and 2 nights which looked like eternal, and trying a dozen data recovery softwares that did nothing, I eventually found one that, in hindsight, was Godsend. That software actually recovered almost every single file and was also free back then. It was then that I created a backup plan for myself and it has worked well so far.
But you missed talking about cloud backups. They are actually much more secure since they are managed professionally, although they come with some privacy concerns.

TheMystic said:
I learnt my lesson the hard way in 2013 or 2014, but I was eventually lucky after spending 2 sleepless nights. Lost all files on my laptop hard disc by passing a command that I didn't fully understand. After 2 days and 2 nights which looked like eternal, and trying a dozen data recovery softwares that did nothing, I eventually found one that, in hindsight, was Godsend. That software actually recovered almost every single file and was also free back then. It was then that I created a backup plan for myself and it has worked well so far.
But you missed talking about cloud backups. They are actually much more secure since they are managed professionally, although they come with some privacy concerns.
Click to expand...
Click to collapse
I never use cloud except for Gmail and text messages backups. Otherwise it's backed up at least 3-6 times on different drives, in different locations including time staggered copies. I may lose some data but never all...

blackhawk said:
I never use cloud except for Gmail and text messages backups. Otherwise it's backed up at least 3-6 times on different drives, in different locations including time staggered copies. I may lose some data but never all...
Click to expand...
Click to collapse
That's one reason why you stick with the N10+ which is the last Samsung flagship with an external SD card. Since this feature isn't coming back on future flagships, you'll either have to settle with a budget device going forward, or get the 1 TB variants of Flagships, if you want access to your entire camera roll all the time.
In either case, you'll eventually run out of storage and may have to setup your own personal cloud server, if you have the required expertise to keep it safe for online access.
Cloud is not just about backups. It is also about having access to files all the time on multiple devices.

TheMystic said:
That's one reason why you stick with the N10+ which is the last Samsung flagship with an external SD card. Since this feature isn't coming back on future flagships, you'll either have to settle with a budget device going forward, or get the 1 TB variants of Flagships, if you want access to your entire camera roll all the time.
In either case, you'll eventually run out of storage and may have to setup your own personal cloud server, if you have the required expertise to keep it safe for online access.
Cloud is not just about backups. It is also about having access to files all the time on multiple devices.
Click to expand...
Click to collapse
Samsung. If they can't put out they will be kicked out. Another manufacturer will pick up the slack. Both Samsung and Gookill Android are a mess now; I will continue to use what fullfills my mission for the next 3+ years. No hurry here.
Currently I'm using about 510 gb of my 1tb capacity, plenty of room left. I also have 350/100gb available on internal.
With cloud you're at the mercy of your internet connection/bandwidth, always. It wastes battery and they will charge you for the "privilege" of high capacity storage.
Multiple more layers to cloud introduce new failure modes and vulnerabilities, KISS.
Lol, do you still trust Samsung servers?
In the future you will own nothing and be happy. Not me.

blackhawk said:
With cloud you're at the mercy of your internet connection/bandwidth, always. It wastes battery and they will charge you for the "privilege" of high capacity storage.
Click to expand...
Click to collapse
Internet today is cheap and convenience has a price. So it is okay.
blackhawk said:
Multiple more layers to cloud introduce new failure modes and vulnerabilities, KISS.
Click to expand...
Click to collapse
They have multiple redundancies built-in and I am positive they have systems in place to prevent catastrophe. I do use multiple cloud providers though, just in case.
blackhawk said:
do you still trust Samsung servers?
Click to expand...
Click to collapse
I don't have the expertise to keep a personal cloud server safe online.
blackhawk said:
In the future you will own nothing and be happy. Not me
Click to expand...
Click to collapse
I have local backups too. It's not like I'm completely dependent on them. The local backups are just backups, and I cannot access them online.

TheMystic said:
I have local backups too. It's not like I'm completely dependent on them. The local backups are just backups, and I cannot access them online.
Click to expand...
Click to collapse
If you had an SD card* you don't need to have internet access at all to do a full reload, anytime, anywhere. If you phone OS crashes the data on the SD card usually remains intact as well as in most hard display smashing drops.
A dual drive device trumps a single drive device every time.
*A OTG flashstick can be used but they are much slower. Backups can't be done in real time and one more critical piece of hardware to lose.

blackhawk said:
If you had an SD card* you don't need to have internet access at all to do a full reload, anytime, anywhere. If you phone OS crashes the data on the SD card usually remains intact as well as in most hard display smashing drops.
A dual drive device trumps a single drive device every time.
*A OTG flashstick can be used but they are much slower. Backups can't be done in real time and one more critical piece of hardware to lose.
Click to expand...
Click to collapse
You're focussing only on backups.
I'm also looking at multi-device access to all files. This is possible only with cloud, whether 3rd party or personally hosted one.

blackhawk said:
If you had an SD card* you don't need to have internet access at all to do a full reload, anytime, anywhere. If you phone OS crashes the data on the SD card usually remains intact as well as in most hard display smashing drops.
A dual drive device trumps a single drive device every time.
*A OTG flashstick can be used but they are much slower. Backups can't be done in real time and one more critical piece of hardware to lose.
Click to expand...
Click to collapse
You're focussing only on backups.
I'm also looking at multi-device access to all files. This is possible only with cloud, whether 3rd party or personally hosted one.

TheMystic said:
You're focussing only on backups.
I'm also looking at multi-device access to all files. This is possible only with cloud, whether 3rd party or personally hosted one.
Click to expand...
Click to collapse
Exactly. Android is the only internet portal I use.
My other Android only shares cloud Gmail and texting for security. My laptop internet/wifi access is always offline; completely physically firewalled. You might hack one device but never all three. All backup drives are always physically/electronically separate from the PC unless being used for backup. In the case of malware none of the backups are connected until the victim device is clean.
I've seen a Gmail account get hacked and become unrecoverable. Never had that happen to a backup hdd... in the end the only protection you have is sound data management. If you fail to do this you may lose your whole database.

blackhawk said:
Exactly. Android is the only internet portal I use.
My other Android only shares cloud Gmail and texting for security. My laptop internet/wifi access is always offline; completely physically firewalled. You might hack one device but never all three.
Click to expand...
Click to collapse
This is a very special use case. For most people, multi-device access is pretty common.
blackhawk said:
I've seen a Gmail account get hacked and become unrecoverable.
Click to expand...
Click to collapse
As in all emails got permanently deleted? And Google couldn't help?