Sometimes you accidentally delete files on your mobile phone and need to run recovery software. With USB Mass Storage in the older devices, one could simply attach the device (or the memory card) to a computer and run some data recovery tool to fix things. With modern Android phones there is no USB Mass Storage anymore, and with an internal memory only-device things get somewhat more complicated. Still, not impossible.
Perhaps you have already read various very good guides on this. I have. But the ones I have seen use Windows, while I prefer to do things directly in my Linux environment without having to start my virtual machine with Windows. In order for myself to remember how to do this the next time I need to, I have created this web page. Perhaps it can be useful for someone else too, so I put it on the WWW for everyone to read.
Now, this is one way to do this kind of recovery. There are other ones as well, but this is the one I used.
NB! This guide was based on recovery on an Android 4.0 device. I grew tired of always having to do things like this now and then using Android, and ditched Android shortly after this web page was made and went for iOS instead. iOS and its ecosystem have many flaws, but none of them annoy me. Android annoys me. I never had to root my iPhone in order to make things happen. I never had to do recovery stuff like this on the iPhones I've had. While Android has seen many improvements since 4.0, I had to do some maintenance on a device with Android 5.0 and 6.0 a while ago and realized all things that annoy me with Android were still the same.
The plan is to use adb to dump out the entire file system to the computer. Then we can run recovery tools on those dumps and recover our files. Typically, the data partition (mounted as SD Card) is a FAT32 system. Other partitions are probably ext3. We will find out and use different recovery tools accordingly.
The programs in the last bullet are probably included in your Linux distribution. If you use Debian, just run
# apt-get install testdisk pv extundelete
$ ./adb shell(NB: You might have to implicitly call
adb start-serveras root first if the command above fails.)
mountcommand to find out what partition holds the SD Card data and dump that one, or we just dump out the entire memory content and skip the thinking part. I find the latter preferable, since the thinking part involved in the first approach is always prone to fail. So then you want to search for a block device called something like
shell@android:/ # ls /dev/block dm-0 dm-1 dm-2 loop0 loop1 loop2 loop3 loop4 loop5 loop6 loop7 mmcblk0 mmcblk0boot0 mmcblk0boot1 mmcblk0p1 mmcblk0p10 mmcblk0p11 mmcblk0p12 mmcblk0p13 mmcblk0p14 mmcblk0p2 mmcblk0p3 mmcblk0p4 mmcblk0p5 mmcblk0p6 mmcblk0p7 mmcblk0p8 mmcblk0p9 ram0 ram1 ram10 ram11 ram12 ram13 ram14 ram15 ram2 ram3 ram4 ram5 ram6 ram7 ram8 ram9 vold zram0 shell@android:/ #Here we see that there are several partitions within
mmcblk0, but we leave it for TestDisk to take care of the partitions later.
sdk/platform-toolson your computer.
/dev/block/mmcblk0that we found to the computer. With
adb shellwe can become superuser and execute
catto dump the content like this:
$ ./adb shell su -c "cat /dev/block/mmcblk0" | pv > mmcblk0.rawPipe Viwer (pv) is optional, but I like to see the transfer progress information it provides.
mmcblk0.rawto some other directory/filename if you want to.)
./adb shell su -c "cat /dev/block/mmcblk0" | pv | sed 's/^M$//' > mmcblk0.raw...where ^M is what you get by pressing Ctrl+V followed by Ctrl+M.
./adb shell "su -c 'stty raw; cat /dev/block/mmcblk0'" | pv > mmcblk0.rawAddition: Tim de Waal wrote to me that he prefers using netcat/gzip instead:
dd if=/dev/block/mmcblk0 | gzip -9 | nc -l 5555On the computer, run:
nc [AndroidIP] 5555 | pv -b > mmcblk0.img.gz
$ testdisk mmcblk0.raw
mmcblk0.rawin the TestDisk interface and choose Proceed:
/DCIM/100ANDROdirectory, where my Android device stores its camera images, we find a lot of files that can be recovered. Select all or some of them, and use either C or c to recover them to one of the Linux computer's file systems (e.g. your home directory):
image.ddof that partition to a file on the Linux computer's file system:
$ extundelete --restore-all image.dd
Hopefully this will help me in the future, when I have forgotten the steps. And perhaps someone else can benefit from this information as well.
Please feel free to e-mail me if you have positive comments or concrete suggestions of changes or updates.
Thank you very much Mathias Brodala, Piotr Biesiada, André Paixão, Marc, Daniel Jeliński and Tim de Waal for sharing your valuable update suggestions and corrections.