Custom recovery can have full access to mtp and adb. But that is out of your reach now.
What about that readback feature on SPFT? It can read back raw data from your emmc regardless of your phone status. But the problem is reading that data. The format is linux ext. Using something that can mount ext images is the solution. I have tried some programs but I can't manage to open it. Trying it won't hurt you anyway.
It requires mi auth bypass so the process is quite the same except instead of flash, go to readback tab.
View attachment 5388369
Figure 6: SPFT Readback Interface
Locate the scatterfile and open it. Find "userdata" string.
View attachment 5388371
Figure 7: Scatter File
Note this two lines :
Code:
physical_start_addr: 0x1d2800000
partition_size: 0x300000000
Back to readback window. Click on Add. It will show a new line in the table. Double click on it.
View attachment 5388375
Figure 8: A new line is added.
After double clicking on it, new window shall appear that ask you where to put the output file. Name it to any name with .img extension. Hit save.
View attachment 5388377
Figure 9: Filesave prompt window
Now input the values following the scatter file. As per "Region", select "USER". Then hit OK.
View attachment 5388381
Figure 10: Input parameters
After that, hit "Readback".
View attachment 5388387
Figure 11: Ready to execute the readback command.
Your redback data will be saved as "yourfile.img".