How can I recover a deleted file on Android?

Question

I just deleted a file on my Nexus S that I really need back. (It was actually part of an app using a sqlite database that did a drop table when upgrading to a new version.)

Presumably I need to root the phone first (which I hear is easy on Nexus phones) but am I in a catch-22 here? Namely, does rooting the phone mean wiping/overwriting the partition where the data lives?

If not, what do you recommend for data recovery tools? Presumably the file was just unlinked and not actively overwritten (per usual when "deleting" a file) so technically the data must be there...

I cannot post an answer, the system goes against me. Worse for them... The most easy way when you have Linux system and your device with TWRP recovery is. 0. First of all! Stop creating new files, close all apps. If you will need to run something, better DELETE first some needless files as much as possible to free more space and get more chances to keep your deleted files intact. Of course you will have to know what partition you need to free. High chances its the one that is mounted as /data (your local and deleted files are in /data/media or something like that). — midenok, May 14 '19 at 14:37

score 37 · Answer 1 · edited Jul 06 '16 at 06:24

37

Manual way

Luckily data recovery on Android isn't different from any other PC/Linux with a flash storage device. You first need root and the dd binary on your device to make a full backup of the block storage device your deleted file was on. dd is sometimes already installed in your system.

Then it's just 3-steps to find out if the file could be recovered:

Find out on which block device the file was on. Via mount
Acquire and image of that block device with dd: dd if=/dev/<blockdevice> of=/sdcard/image bs=4096
Get a data recovery forensics tool and let it search /sdcard/image for the lost file. You can of course try to run multiple tools on the image. Foremost and Scalpel are a good start.

"Undelete" App

There is a new App called "Undelete Beta" which can recover files on the internal storage and the SD card. The App is beta and has some restrictions.

If the file is really important, I would always choose the "Manual Way".

edited Jul 06 '16 at 06:24

Marc.2377

464
3
8
23

answered Nov 21 '11 at 09:33

Flow

18,464
16
79
138

For rooting see this question. I have no Nexus S, but I would say: No, no and sometimes. – Flow Nov 21 '11 at 19:24
1

@Flow: a) I really wouldn't touch the affected partition any further but unlock the Nexus and 'fastboot boot cwm.img' for a tmp recovery. b) Preferably use adb on the fly to transmit the partition data off the phone (no intermittent storing on /sdcard) using stdout+gzip+uuencode c) carving: sqlite3 has no footer, but a header "SQLite format 3". Using foremost it's best to define a max-size and maybe 'NEXT' (indicating EOF if any other new header is found). OK if I edit? – ce4 Jul 12 '12 at 17:33
1

+1 for 'scalpel'! Haven't known before. BTW: Testdisk's photorec is also quite useful (for standard file types like .jpg ans such) – ce4 Jul 12 '12 at 17:37
what if the device to backup is bigger than 4gb ? – David V. Sep 28 '13 at 08:16
@ce4 the manual method won't work in my case. My android tablet is mounted via mtp So, there isn't any block device on which my android is mounted, rather it's a folder. I can't run dd command then. How to proceed ahead please! – Ravi Apr 25 '15 at 14:08
mtp is a high level access protocol which is not sufficient. You need root access on your device in order to access the underlying block device in raw mode using dd (e.g. via custom recovery). – ce4 May 20 '15 at 08:03

ajdev8 · Answer 2 · 2014-10-14T20:28:54.277

14

As of Android 4.3+ and the implementation of TRIM it is now incredibly difficult to recover deleted files on the internal memory.

Some of the suggested solutions probably will not be worthwhile unless you are able to scan the memory for the deleted file(s) very rapidly after deletion.

Moreover, in the case of recovery after a factory reset, as of Android 4.0+ a factory reset now ends up doing a secure erase (or similar operation) so that all data is irrevocably gone.

Reference:

TRIM on Wikipedia
Android bug report
Android Security Team security best practices

edited Oct 14 '14 at 20:28

answered Oct 13 '14 at 07:43

ajdev8

548
4
7
19

1

I assume this is the correct answer in 2019? – ripper234 Nov 03 '19 at 04:26

score 8 · Answer 3 · answered Nov 23 '11 at 17:07

8

The new Undelete Beta may be helpful here if you don't want to involve a PC. Any time you write to storage you risk overwriting the deleted file, but rooting shouldn't wipe.

answered Nov 23 '11 at 17:07

Matthew Read

50,567
30
145
273

How can I recover a deleted file on Android?

3 Answers3

Manual way

"Undelete" App

Linked

Related