2

My phone is a Motorola MOTO G (first generation). Due to some troubles, I had recovered the factory settings of my phone. But I forget to backup some data of an app (Tricount). A this point my phone was not rooted.

My question is: is it possible to recover the data files of this application?

Currently, I just rooted my phone and I am currently making a RAW copy of the android system using command adb shell su -c "cat /dev/block/mmcblk0" | pv > mmcblk0.raw. My idea is to used extundelete command to recover the files after extracted the partitions using Testdisk.

Do you recommend to search files in a specific partition? I am not really familiar with the android filesystem...

EDIT: One other method (I don't have tested yet). In terminal 1

adb forward tcp:5555 tcp:5555

adb shell

su

/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12

In terminal 2

adb forward tcp:5555 tcp:5555

nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw

NB: websites:

EDIT: unfortunately, it seems that Android overwrites the files when you recover the factory settings (for security raesons) and so it is impossible to recover the files... :-(

Community
  • 1
Guuk
  • 121
  • 3
  • based on the conversation in the answer below, take a look at this link. I have no actual experience with any of this, and from your question, you know more about this than I do. I hope you are able to recover. Good luck. (I hope you stick around here and help others with their data recovery problems in the future :)) – Ryan Conrad Jan 02 '15 at 17:59
  • 1
    @RyanConrad ;-) I am already following this link. But I am not sure that the extracting command is good. Currently I can only extract a 4gb+ RAW file but my phone normally have 16gb... – Guuk Jan 02 '15 at 18:02
  • this could be relevant information. I am using my "GoogleFu" and grabbing some straws for information. From that doc, looks like userdata is @ /dev/block/mmcblk0p5 – Ryan Conrad Jan 02 '15 at 18:10
  • 1
    @RyanConrad One command to know on which partition is userdata: ls -al /dev/block/platform/msm_sdcc.1/by-name/. I obtain one line with : lrwxrwxrwx root root 1970-09-23 09:51 userdata -> /dev/block/mmcblk0p36... – Guuk Jan 02 '15 at 18:15
  • 1
    I don't have sufficient level so I propose one new link : !!! http://forum.xda-developers.com/showthread.php?t=1818321 – Guuk Jan 02 '15 at 18:50
  • I suggest you also look at How can i recover a deleted file on android if you haven't already. This is for sdcard card file, but it should be relevant with your userdata block as well. – Ryan Conrad Jan 02 '15 at 18:56
  • @RyanConrad Thx. I already saw it but I want to avoid to write on the internal memory (and overwrite existing files). – Guuk Jan 02 '15 at 18:59
  • Let us continue this discussion in chat. – Ryan Conrad Jan 02 '15 at 19:02
  • @RyanConrad In fact I cant... My reputation is too low (20 required)... – Guuk Jan 02 '15 at 19:15
  • I put this in chat: would the "manual" steps in the answer require it to write to internal storage? dd if=/dev/ of=/storage/sdcard1/image.img bs=4096 for example, would read from /dev/ and write the image to the external storage. then on PC you could use a data recovery tool to look at the .img instead of trying to read off the device, and, you would have a "copy" of the image, so you dont have to worry about additional data loss from writes. – Ryan Conrad Jan 02 '15 at 19:18
  • @RyanConrad /storage/sdcard1/ is on the phone? because in my phone, I don't have any SDcard – Guuk Jan 02 '15 at 19:21
  • Ok, wasn't aware that phone didnt have sd card slot, sorry. if you write to /storage/sdcard0/ and that is on a different block, would it overwrite areas for the userdata block? I would think no, but it is just a guess. I think that creating the image using dd might be the best option, because then you have an exact image of it "now". you only need to turn the phone on, create the image, copy it, then turn it off. Otherwise you risk other apps writing to userdata block and corrupting the data. – Ryan Conrad Jan 02 '15 at 19:30
  • 1
    @RyanConrad I am currently creating the image using dd. About 1h for 16gb.... – Guuk Jan 02 '15 at 19:33

1 Answers1

0

What kind of App is Tricount? Meaning is it came pre-installed in your phone or you download it from Play store such as Google Play Store?

Answer to above question is IMP as Android File system maintain clear distinction between system apps (which are shipped by your device OEM) and Downloaded apps.

Assuming that it is a downloaded app, you can check below location: /data/data/app-package-name Where app-package-name is the name of the package (Given by the Developer who developed Tricount app).

AADAndroidEnthusiasts
  • 2,357
  • 4
  • 31
  • 48
  • Tricount is an app I have downloaded on the Google Play Store. – Guuk Jan 02 '15 at 17:48
  • You can check for /data/data/app-package-name for Tricount. All it's data (including databases used internally by app), will be held inside it. – AADAndroidEnthusiasts Jan 02 '15 at 17:50
  • Even if it was a system app, the "data" for the app is stored in the "user data" on the system storage. This "user data" is cleared when you perform a factory reset. In short, unless the app syncs data to google cloud services, the likelihood of you able to recover it is slim (at best) – Ryan Conrad Jan 02 '15 at 17:51
  • 1
    @RyanConrad but the files is rewrited or just deleted? My idea is to use recovery tools... – Guuk Jan 02 '15 at 17:53
  • ADB provides one in-build way to provide back up. adb backup -noapk com.your.packagename – AADAndroidEnthusiasts Jan 02 '15 at 17:54
  • You could try recovery tools, but the problem with those is they usually need low level access to the storage, which you probably wont be able to get. And after you "factory reset", you then probably booted the phone, which starts writing "new data" over the old, deleted data. So even if you can access with recovery tools, the chances that the data has been corrupted with over-writes is high. – Ryan Conrad Jan 02 '15 at 17:55
  • @AADTechnical backup will not help as the data has been deleted. – Ryan Conrad Jan 02 '15 at 17:56
  • 1
    @RyanConrad I agree with you. But I want to try. What do you think about my command to extract a RAW copy of the data? – Guuk Jan 02 '15 at 18:00