This is the same tutorial written by Wartickler at this link. Thanks for his efforts, his work is appreciated.
Here we bring minor changes to the tutorial for those of you who are facing problems accomplishing the procedures.
The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But still there is a hope.....
The Process
My phone is the Samsung Galaxy s4 (GT-I9500) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
The Requirements
The Work
Good Luck :good:
Here we bring minor changes to the tutorial for those of you who are facing problems accomplishing the procedures.
The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But still there is a hope.....
The Process
My phone is the Samsung Galaxy s4 (GT-I9500) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
- back up the entire internal memory partition to your computer as a single, massive .RAW file,
- convert the .RAW file output to a VHD,
- mount the VHD as a disk in Disk Manager,
- scan the attached VHD volume for files that have been deleted and recover them,
The Requirements
- A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
- BusyBox installed on your device,
- Cygwin installed to [c:\cygwin] with pv and util-linux from the repo (at the package selection screen search for pv then util-linux and click on Default to change it to Install). Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\samsung] to put the exported .RAW file,
- Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
- ADB - You can use minimal adb and fastboot which is 2MB only. Attached, find the link at the bottom of this post. (make sure adb.exe is in your path. Path is in System Properties -> Advances -> Environment Variables -> System variables -> Path and add to the end: ";C:\Program Files\Android\sdk\platform-tools" or where ever you placed your adb.exe),
- USB Debugging enabled on your device,
- VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\samsung],
- Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
- A calm sense of peace and serenity that you will get your files back... :fingers-crossed:
The Work
- *****Based on the number of people having trouble with this step it is now my recommendation that you choose to recover your entire memory block instead of just the data partition. In my phone's case that is mmcblk0. Please discover if yours is different.
[*]*****For identifying which block/partition you want to recover, install DiskInfo from Playstore. Open the app and click on Data (USERDATA) to see the partition name for yours. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p21
- Turn on your phone
- Connect the phone in ADB mode
- Unlock the screen.
- Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
*Remember to enter codes line-by-line. After you enter su, you have to grant permission on your mobile phone at the same time
Code:adb forward tcp:5555 tcp:5555 adb shell su /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p21 - Open another Cygwin terminal and enter:
[*]Depending on the size of partition it may take a while to backup.Code:adb forward tcp:5555 tcp:5555 cd /samsung nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p21.raw - We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\samsung], and type:
Code:
VhdTool.exe /convert mmcblk0p21.raw - Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
- Select Storage-->Disk Management.
- In the menu select Action-->Attach VHD.
- For Location enter [c:\cygwin\samsung\mmcblk0p21.raw] and select the OK button.
- Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
- Select the GPT (GUID Partition Table) radio button and select the OK button.
- Right-click on the Unallocated space and select New Simple Volume...
- In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
- A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
- Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
- A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
- Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
- The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
- ?
- Profit! :victory:
Good Luck :good:
Last edited:
