23

So it came to pass, that Amanda did have a blonde moment and deleted all her threads in the SMS app by mistake. Yeah, "Delete all threads" probably shouldn't be quite so easy to invoke.

The phone's a ZTE Blade, with all its user data inconveniently stored on a YAFFS2 filesystem.

I have an old back up, but the SMS I need to recover are from since then. There are probably some on the SIM card, so I've ordered a SIM reader. I suspect that the twenty or so it holds are mostly network operator spam, anyway.

So, I curse my ineffectual backup plan and vow to back up SMS to GMail in future.

Meanwhile, I resolve to recover mmssms.db, or what's left of it.

First up, I connect adb and check the mounts, then attempt to copy the block to an image on the SD card:

dd if=/dev/block/mtdblock6 of=/sdcard/data.img

No such luck. I reason forcibly dismounting would be a bad idea, and probably won't work in any case.

So, I upload a statically linked copy of busybox to the SD card and use the conv=noerror option.

What I ended up with was a file that kept increasing in size until the SD card filled up.

What am I doing wrong? Does ClockworkMod take an image in the true sense or does it just back the files up and pack them into an image? Is there a YAFFS2 recovery program? (The two papers I've read make it seem feasible but I haven't seen even PoC code)

Any clues gratefully received/

Edit: The phone is rooted. Very rooted :)

Further edit:

Most of the messages found in mmssms.db-wal:

ls -al /data/data/com.android.providers.telephony/databases
drwxrwx--x    1 radio    radio         2048 Jul 17 20:16 .
drwxr-xr-x    1 radio    radio         2048 Oct 26  2011 ..
-rw-rw----    1 root     root         60416 Jul 17 20:16 mmssms.db
-rw-rw----    1 radio    radio        32768 Jul 17 16:18 mmssms.db-shm
-rw-rw----    1 radio    radio       628832 Jun 30 19:23 mmssms.db-wal
-rw-rw-rw-    1 root     root         60416 Jul 17 20:16 mmssms.db.xxx
-rw-rw----    1 radio    radio       132096 Jun 18 13:25 telephony.db
-rw-rw----    1 radio    radio        32768 Jul 16 22:14 telephony.db-shm
-rw-rw----    1 radio    radio       106928 Jul 16 22:14 telephony.db-wal

With any luck, SMS Backup & Restore will allow a merge.

Izzy
  • 91,166
  • 73
  • 343
  • 943
Mandy
  • 335
  • 1
  • 2
  • 7

1 Answers1

19

The sms database is stored in /data/data/com.android.providers.telephony/databases/mmssms.db which is what you want to do.

Best thing to do, is this, do not plug in USB cable yet:

  1. Reboot into ClockWorkmod Recovery.
  2. Go into Mounts and Storage
  3. Select mount /data
  4. Plug in the USB
  5. From the windows command shell or terminal, adb shell
  6. Since you are in ClockworkMod Recovery, you are root by default, now do this cp /data/data/com.android.providers.telephony/databases/mmssms.db /sdcard/MySmsDatabase.db
  7. exit out of the adb shell by typing in this: exit
  8. Now your database is copied to the SD-Card.
  9. Back out of ClockworkMod recovery and just reboot, the recovery will unmount /data for you.

At this stage your database is now copied across. And can be safely extracted via using something like SqliteMan. HTH.

Edit: The OP was interested to know how a dump can be done. - Read on :)

When you invoke this (with USB plugged in and within the adb shell)

sh-4.1# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00500000 00020000 "recovery"
mtd1: 00500000 00020000 "boot"
mtd2: 00120000 00020000 "splash"
mtd3: 00080000 00020000 "misc"
mtd4: 02580000 00020000 "cache"
mtd5: 0d700000 00020000 "system"
mtd6: 0cb80000 00020000 "userdata"
mtd7: 00020000 00020000 "oem"
mtd8: 00180000 00020000 "persist"

Knowing which partition is the key.. So for example from my Blade, I can see that userdata is on the partition mtd6, in which the actual partition information can be found within /dev/mtd/mtdX so its a matter of doing this using cat:

cat /dev/mtd/mtd6 > /sdcard/myuserdata.dump

And from there, taking the /sdcard/myuserdata.dump, depending on the filesystem used on that partition, it can be mounted via loop-back. The mileage will vary and of course, its a chicken-and-egg situation, in order to do all of that, the handset needs to be rooted.

t0mm13b
  • 13,436
  • 1
  • 48
  • 58
  • That was most helpful, all (or at least most) of the deleted SMS were in mmssms.db-wal:

    Many thanks for the useful pointer!

     – Mandy Jul 17 '12 at 19:32
  • Now just need to convince sqlite it really does want to take the WAL file and revert those DELETE FROM statements to the mmssms.db. If I get a breakthrough I'll post the outcome here as this is typically what someone searching for a way to restore deleted SMS threads would be looking for. – Mandy Jul 19 '12 at 00:01
  • here's an answer how to get a whole partition off a device. Needs Linux, an adb enabled CWM recovery and knowledge of your device's partition layout (i.e. whats the /data partition's device, /dev/block/?) – ce4 Jul 19 '12 at 07:18
  • @t0mm13b: Yaffs2 cannot be mounted using the loop-back technique. Yaffs2 is a flash file system and depends heavily on a 'MTD chip', see Wikipedia for more. (It's due to some NAND's extra bytes per area that are used for wear leveling and are not part of the real data). If you read the block device you only get the user-visible data, not the extra flags back. If you want to mount a YAFFS2 image, you need a MTD simulator (the Android SDK has one included, you can specify an additional .img for a VM (or overwrite the data.img)) – ce4 Jul 19 '12 at 08:17
  • Has this moved? I can't find /dev/mtd/* at all, under 4.4.4 on an s5 ... instead it seems userdata is mounted from this block device: /dev/block/platform/msm_sdcc.1/by-name/userdata – digitalextremist Jul 17 '15 at 12:13