[Q] How to recover data and reset flash counter when phone won't boot

My S3 went haywire a few days ago and in my attempts to recover data I loaded the TWRP bootloader and a custom ROM hoping I could eventually reboot it and reset the flash counter. Unfortunately, it still won't reboot - it hangs on the pulsing SAMSUNG animation, after the "Samsung Galaxy SIII" splash screen and the Android blast-off animation.

I've already done a cache wipe and factory reset so ideally I'd like to get it into a state where I can run data recovery software to retrieve my deleted files. But if that can't be done, at the least I want to reset the flash counter so the phone will be replaced under warranty.

Since I received the last replacement in Oct 2013 I forgot to enable USB Debugging and I didn't root phone. In my searches, it looks like the power button is stuck (doesn't feel like it, though) and the phone randomly reboots when is Recovery Mode or Download Mode. About 10% of the time I can get it into either mode and remain stable.

Tools I downloaded & installed:
SkipSoft Android Toolkit (updated and registered)
Samsung USB Drivers v1.5.42.0
Google ADT (updated)
Odin 3.09

Here's what I haven/haven't done so far:

1. Haven't enabled USB Debugging in the OS
2. Haven't rooted phone
3. Installed TWRP 2.7.0.0
4. Installed root66_TMO_T999UVDMD5.tar, but device still won't boot completely

After TWRP installed, I had to updated driver in Device Manager to "Intel USB Flash Loader Utility" from Samsung. In the TWRP logs I see:
E: Could not mount /data and unable to find crypto footer.
E: Unable to mount '/data'
E: Unable to recreate /data/media folder.
Updating partition details...
E: Unable to mount '/data'
E: Unable to mount internal storage.
E: Unable to mount /data/media during GUI startup.
Full SELinux support is present.
Running boot script...
Finished running boot script.
E: Unable to mount /data/media/TWRP/.twrps when trying to read settings file.
E: Unable to mount '/data'

Do I have any hope of recovering the data or resetting the flash counter? I've also considered trying JTAG recovery through a local vendor, but still would like to reset the counter.

Thanks - any help would be GREATLY appreciated.

some progress

OK, with some persistence I managed to get the device to a bootable state. I managed to installed TWRP Bootloader and Chainfire's SuperUser, and that got the phone bootable. Android version is 4.1.2, USB Debugging is now ON, and I went through the setup process but disabled all antennas once I noticed it was downloading content.... PHEW...

For anyone dealing with this issue, here's what worked and didn't:
1 - Spraying CRC brand circuit cleaner on power button - didn't try it, too lazy/scared that I'd break something else
2 - Knocking Power button with a pencil eraser (found elsewhere in xda-developers forum) - this seemed to clear up the issue intermittently
3 - Loaded TWRP using Odin - this worked
4 - Loaded Chainfire AutoRoot - this failed when using miscellaneous tutorials online, BUT it worked when I went straight to the CF Autoroot site (autoroot.chainfire.eu) downloaded the specific file for my device, and loaded it via Odin

Now I'm trying to get data recovery software to recognize the device to analyze the drive and find any recoverable data. Any suggestions?

So far I've tried:
Recuva - unable to see phone
Asoftech Data Recovery - unable to see phone
Glary Undelete - unable to see phone
yodot - unable to see phone

DocHoliday77 said:

Search xda for an app called Easy UMS. (I think). Then use it to connect as a USB Mass Storage device. If that doesn't help im not sure what else to tell you.

Click to expand...

Click to collapse

DocHoliday - thanks for the tip, but Easy UMS only allows access to the external SD card. I'm continuing my search. There must be something that at least allows a full bit-wise backup of the entire device to an SD card that I can then use for forensics.

maradamc said:

DocHoliday - thanks for the tip, but Easy UMS only allows access to the external SD card. I'm continuing my search. There must be something that at least allows a full bit-wise backup of the entire device to an SD card that I can then use for forensics.

Click to expand...

Click to collapse

It looks like BusyBox and the DD command can create a bit-by-bit partition dump but I'm not sure how to issue the commands. I have ADB and SU access, BusyBox installed.

Thanks Doc! I reformatted my external SD Card to exFAT, then ran the DD command to dump the userdata partition. I'm using DiskInternals Linux Recovery right now to scan the image for any recoverable files.

Where can I find more info on those different partitions in /dev/block/? I think some of the files I want to recover are in /data/data/ and I don't know which partition that would be. I've tried "mount" and "ls -l /dev/block/platform/*/by-name/" but I can't find any reference to a /data/ mount.

My last shot will be to downgrade the OS to ICS version and try data recovery directly via the USB cable. All this stuff I'm finding sure will make a good tutorial afterwards.

I did some digging and found I need to pull data from:
/sdcard/callrecorder/
/storage/emulated/0/sounds/

I'm trying to decipher if I need to dump any additional partitions. No luck finding much useful information on S3 partitions - this was the closest I found - http://xdaforums.com/galaxy-s3/general/galaxy-s-iii-partition-layout-basic-efs-t1689623

In ADB, I retrieved the following, but none of them obviously map to sdcard or storage/emulated.

ls -l /dev/block/platform/*/by-name/
lrwxrwxrwx root root 1969-12-31 22:16 aboot -> /dev/block/mmcblk0p5
lrwxrwxrwx root root 1969-12-31 22:16 backup -> /dev/block/mmcblk0p20
lrwxrwxrwx root root 1969-12-31 22:16 boot -> /dev/block/mmcblk0p7
lrwxrwxrwx root root 1969-12-31 22:16 cache -> /dev/block/mmcblk0p17
lrwxrwxrwx root root 1969-12-31 22:16 efs -> /dev/block/mmcblk0p11
lrwxrwxrwx root root 1969-12-31 22:16 fota -> /dev/block/mmcblk0p19
lrwxrwxrwx root root 1969-12-31 22:16 fsg -> /dev/block/mmcblk0p21
lrwxrwxrwx root root 1969-12-31 22:16 grow -> /dev/block/mmcblk0p23
lrwxrwxrwx root root 1969-12-31 22:16 modem -> /dev/block/mmcblk0p1
lrwxrwxrwx root root 1969-12-31 22:16 modemst1 -> /dev/block/mmcblk0p12
lrwxrwxrwx root root 1969-12-31 22:16 modemst2 -> /dev/block/mmcblk0p13
lrwxrwxrwx root root 1969-12-31 22:16 pad -> /dev/block/mmcblk0p9
lrwxrwxrwx root root 1969-12-31 22:16 param -> /dev/block/mmcblk0p10
lrwxrwxrwx root root 1969-12-31 22:16 persist -> /dev/block/mmcblk0p16
lrwxrwxrwx root root 1969-12-31 22:16 recovery -> /dev/block/mmcblk0p18
lrwxrwxrwx root root 1969-12-31 22:16 rpm -> /dev/block/mmcblk0p6
lrwxrwxrwx root root 1969-12-31 22:16 sbl1 -> /dev/block/mmcblk0p2
lrwxrwxrwx root root 1969-12-31 22:16 sbl2 -> /dev/block/mmcblk0p3
lrwxrwxrwx root root 1969-12-31 22:16 sbl3 -> /dev/block/mmcblk0p4
lrwxrwxrwx root root 1969-12-31 22:16 ssd -> /dev/block/mmcblk0p22
lrwxrwxrwx root root 1969-12-31 22:16 system -> /dev/block/mmcblk0p14
lrwxrwxrwx root root 1969-12-31 22:16 tz -> /dev/block/mmcblk0p8
lrwxrwxrwx root root 1969-12-31 22:16 userdata -> /dev/block/mmcblk0p15

root@android:/ # mount
mount
rootfs / rootfs ro,relatime 0 0
tmpfs /dev tmpfs rw,nosuid,relatime,mode=755 0 0
devpts /dev/pts devpts rw,relatime,mode=600 0 0
proc /proc proc rw,relatime 0 0
sysfs /sys sysfs rw,relatime 0 0
none /acct cgroup rw,relatime,cpuacct 0 0
tmpfs /mnt/asec tmpfs rw,relatime,mode=755,gid=1000 0 0
tmpfs /mnt/obb tmpfs rw,relatime,mode=755,gid=1000 0 0
none /dev/cpuctl cgroup rw,relatime,cpu 0 0
/dev/block/platform/msm_sdcc.1/by-name/system /system ext4 ro,relatime,user_xattr,barrier=1,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/userdata /data ext4 rw,nosuid,nodev,relatime,user_xattr,barrier=1,journal_async_commit,data=ordered,noauto_da_alloc,discard 0 0
/dev/block/platform/msm_sdcc.1/by-name/cache /cache ext4 rw,nosuid,nodev,relatime,user_xattr,barrier=1,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/persist /persist ext4 rw,nosuid,nodev,relatime,user_xattr,barrier=1,data=ordered 0 0
/dev/block/platform/msm_sdcc.1/by-name/modem /firmware vfat ro,relatime,gid=1000,fmask=0006,dmask=0006,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro 0 0
/dev/block/platform/msm_sdcc.1/by-name/efs /efs ext4 rw,nosuid,nodev,relatime,user_xattr,barrier=1,data=ordered 0 0
/sys/kernel/debug /sys/kernel/debug debugfs rw,relatime 0 0
/dev/fuse /storage/sdcard0 fuse rw,nosuid,nodev,noexec,relatime,user_id=1023,group_id=1023,default_permissions,allow_other 0 0

Additionally, the DD for userdata is 12GB while the whole device is 16GB... still trying to figure out how to capture the remaining 4GB. And to complicate things, I've gotten data recovery software to recognize the image dump and scan it, but the files I want have uncommon file extensions (*.m4a, *.3ga) or no extensions at all. <sigh>... it's gonna be a long week...

Thanks for that table! I noticed that link wasn't for the T999, which is why I hesitated to rely on it. IDK why I'm having such a hard time finding info on the T999.

Anyway, I managed to DD every single partition by running:
dd if=/dev/block/mmcblk0p5 of=/storage/extSdCard/aboot.img
dd if=/dev/block/mmcblk0p20 of=/storage/extSdCard/backup.img
dd if=/dev/block/mmcblk0p7 of=/storage/extSdCard/boot.img
dd if=/dev/block/mmcblk0p17 of=/storage/extSdCard/cache.img
dd if=/dev/block/mmcblk0p11 of=/storage/extSdCard/efs.img
dd if=/dev/block/mmcblk0p19 of=/storage/extSdCard/fota.img
dd if=/dev/block/mmcblk0p21 of=/storage/extSdCard/fsg.img
dd if=/dev/block/mmcblk0p23 of=/storage/extSdCard/grow.img
dd if=/dev/block/mmcblk0p9 of=/storage/extSdCard/pad.img
dd if=/dev/block/mmcblk0p10 of=/storage/extSdCard/param.img
dd if=/dev/block/mmcblk0p16 of=/storage/extSdCard/persist.img
dd if=/dev/block/mmcblk0p18 of=/storage/extSdCard/recovery.img
dd if=/dev/block/mmcblk0p6 of=/storage/extSdCard/rpm.img
dd if=/dev/block/mmcblk0p2 of=/storage/extSdCard/sb11.img
dd if=/dev/block/mmcblk0p3 of=/storage/extSdCard/sb12.img
dd if=/dev/block/mmcblk0p4 of=/storage/extSdCard/sb13.img
dd if=/dev/block/mmcblk0p22 of=/storage/extSdCard/ssd.img
dd if=/dev/block/mmcblk0p14 of=/storage/extSdCard/system.img
dd if=/dev/block/mmcblk0p8 of=/storage/extSdCard/tz.img
dd if=/dev/block/mmcblk0p15 of=/storage/extSdCard/userdata.img

For data recovery, I'm running windows and have installed several tools so I'm able to mount the Linux image as a drive.
Cygwin - I've only played with basics in *nix terminal but am comfortable using command prompt
Ext2Fsd
DiskInternals (Linux Reader & Recovery)
OSFMount

I'll tally up the data recovery/carving tools I've downloaded and tried. Now that I have the images dumped, I'm installing ICS 4.0.4 in an attempt to get USB drive access and try the data recovery software directly against the device.

I will remember that. Any suggestions where to track down /storage/emulated/0/sounds/ from a partition perspective?

I just finished flashing down to ICS 4.0.4. Even though Odin said it was successful, it's hanging on boot-up at the pulsing Samsung logo just like when this whole mess started. Time for another Factory Reset... not like I can do any more harm.

Nice! My list of pulled partitions matches the one you provided. Glad to know I was on the right track.

So now I have Android 4.0.4 installed on my device. The problem I have now is that the device isn't recognized in Windows and I can't find a driver for it to work. I've tried Samsung_USB_Driver_for_Mobile_Phones_v1.5.14.0 and v1.5.42.0 - no go. Also tried the ADT driver (android_winusb.inf), still no go. Also tried the driver bundled with the Unified Android Toolkit (by SkipSoft, an XDA dev'r) - no luck. Any suggestions? It must be a driver that supports the old USB Drive mode instead of MTP.

For others who might try this downgrade, I rebooted the device into Download mode and during installation, Odin kept getting an error before finishing. I think it was because I was trying to multitask on the computer because once I let Odin do its thing with and stepped away from the PC, the installation completed successfully. Reboots then kept freezing up but a Factory Reset resolved that.