[GUIDE] Internal Memory Data Recovery - Yes We Can!

[Wartickler]

This method does not seem to work on newer phones that apply TRIM or some other type of partition clearing implementation. If anyone has recovered their data on a device newer than Android 4.3 please pm me and let me know.

The Preamble
Did you delete all your SDCard data?
Are you pissed because no one told you before you unlocked your bootloader what would happen?
Did you lose valuable pictures of cats doing wondrously funny things? :laugh:
Well now there's a convenient new way for you to get that data back Buckaroo!

The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But, cry no more cream-puff! :crying:

The Process
My phone is the Samsung Galaxy Nexus (toro) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:

• back up the entire internal memory partition to your computer as a single, massive .RAW file,
• convert the .RAW file output to a VHD,
• mount the VHD as a disk in Disk Manager,
• scan the attached VHD volume for files that have been deleted and recover them,
• ?
• profit! :good:

The Requirements

• A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
• BusyBox installed on your device,
• Cygwin installed to [c:\cygwin] with pv and util-linux from the repo. Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\nexus] to put the exported .RAW file,
• Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
• ADB (make sure adb.exe is in your path),
• USB Debugging enabled on your device,
• VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\nexus],
• Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
• A calm sense of peace and serenity that you will get your files back... :fingers-crossed:

The Work

1. *****Based on the number of people having trouble with this step it is now my recommendation that you choose to recover your entire memory block instead of just the data partition. In my phone's case that is mmcblk0. Please discover if yours is different.***** Identify which block/partition you want to recover. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p12
2. Turn on your phone
3. Connect the phone in ADB mode
4. Unlock the screen.
5. Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
   

   adb forward tcp:5555 tcp:5555
   adb shell
   /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12

6. Open another Cygwin terminal and enter:
   

   adb forward tcp:5555 tcp:5555
   cd /nexus
   nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw

7. Run around the house a few times. For 32GB internal memory this is going to take 3+ hours. That's a lot of running. When it's done...
8. We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\nexus], and type:

   VhdTool.exe /convert mmcblk0p12.raw

9. Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
10. Select Storage-->Disk Management.
11. In the menu select Action-->Attach VHD.
12. For Location enter [c:\cygwin\nexus\mmcblk0p12.raw] and select the OK button.
13. Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
14. Select the GPT (GUID Partition Table) radio button and select the OK button.
15. Right-click on the Unallocated space and select New Simple Volume...
16. In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
17. A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
18. Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
19. A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
20. Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
21. The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
22. ?
23. Profit! :victory:

The Appendix
The following links helped me to create this modern marvel - mad props to scandiun! :

• [GUIDE] How to make a nandroid backup directly to your computer without using sdcard
• [Info] List of Samsung Galaxy Nexus GT-I9250 devices and partitions
• How to Create and Attach a Virtual Hard Disk in Windows 7

Good luck!

 

[scandiun]

I forgot to mention, but run commands inside android as superuser or may fail (just after adb shell):

adb forward tcp:5555 tcp:5555
adb shell
[B]su[/B]
/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12

And greetings for the guide, I didn't know of VHD Tool, congratulations!.

 

[oliverpowell]

Great Work

I forgot to mention, but run commands inside android as superuser or may fail (just after adb shell):

adb forward tcp:5555 tcp:5555
adb shell
[B]su[/B]
/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12

And greetings for the guide, I didn't know of VHD Tool, congratulations!.

Good and informative tutorial indeed. Thanks though.

 

[Wartickler]

Good point...

I forgot to mention, but run commands inside android as superuser or may fail (just after adb shell):

adb forward tcp:5555 tcp:5555
adb shell
[B]su[/B]
/system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12

And greetings for the guide, I didn't know of VHD Tool, congratulations!.

Thank you again scandiun

You may be right about the superuser command: su

For my part I did not have to use it but I'm sure it wouldn't hurt to run as su. Some systems may actually need it though.

 

[Wartickler]

Here's hoping...

Good and informative tutorial indeed. Thanks though.

Thank you oliverpowell

I just hope the people who need this actually find it before they give up and start overwriting their lost data. Even having to get root access may cause a certain amount of data loss for some. Thankfully I was already rooted and already had busybox....

 

[marhensa]

YOU..
YES YOU....!!!!!
WHERE HAVE YOU BEEN ALL MY LIFE?

s*it mate, i wish this thread comes earlier...
i lost my precious files on sdcard about 3 months ago when unlocking bootloader.

um..
anyway do you have any idea how to make files from computer back to internal memory,
but without changing the date modified timestamp?

i'm using adb push for that, but that's painfuly slow..
while mtp transfer messed up the date modified.

thanks, bookmarked.
just in case i do something stupid next time..

 

[Wartickler]

Not many options...

um..
anyway do you have any idea how to make files from computer back to internal memory,
but without changing the date modified timestamp?

i'm using adb push for that, but that's painfuly slow..
while mtp transfer messed up the date modified.

I'm afraid painfully slow is probably the only option, just like my step that takes three hours. Start it and go build a birdhouse or window box for flowers....it's going to take a while.
I'm sorry you lost files. It's very sad to hear some of the stories of people losing pictures of their children's birth, or the last pictures of their husband going to Afghanistan... and not returning.

I'm hoping that this approach or one like it can be made popular. It needs to get out there.

 

[efrant]

I've also linked this thread and scandiun's thread in the second post of this sticky thread.

 

[Wartickler]

Nice!

I've also linked this thread and scandiun's thread in the second post of this sticky thread.

It looks good! Thank you.

 

[xda_toronto]

Thanks for this tutorial. :good: It worked as indicated. I just wish I knew earlier as I had been trying for the past few days to use recovery tools and trying to make the internal drive USB Mass Storage capable when all this time there was this tutorial. Unfortunately, it only returned a dozen photos. Thanks again for this tutorial... this should be spread across xda forums for any others running into these issues.

 

[Wartickler]

Thanks again for this tutorial... this should be spread across xda forums for any others running into these issues.

Agreed - lol

Firstly, I only recently created this guide. I'm sorry you lost files

Secondly, I attempted to link to older threads that mention the same issue so that they would be more likely to show up in a future Google search but I was scolded for waking up old threads, which makes sense. I just thought this was a rather seriously important issue that deserves a lot of eyes. Loss of personal photos is a little more significant than troubleshooting a bad ROM flash, IMO. But the Mod correctly canceled those other posts. It is a little douchey to try to increase a post count by linking all over to a single (my first, really) post. However, I couldn't give less of a pbbbttt about post counts. If you don't mind me asking, how did you find this thread?

Lastly, if you add it to your sig then this will show up on all of your posts...just sayin'...

I'm glad it at least helped you get 12 pics back...

 

[Med1a]

Proplem

Sir .. I'm facing problem .. it won't receive any data from 5555 port .. I tried to make it copy the RAW file but it stopped without getting any data .. is that normal ?? see the picture attached

 

[CADude]

I have a question. Let's say we don't want somebody to ever use this guide to recover our stuff after we sell them a phone. What's the most secure and thorough way to destroy all data on the Gnex, making it impossible to recover, short of destroying the phone?

 

[hetunandu]

Sir .. I'm facing problem .. it won't receive any data from 5555 port .. I tried to make it copy the RAW file but it stopped without getting any data .. is that normal ?? see the picture attached

i have the same problem

 

[Wartickler]

A couple things from you screenshots...

Sir .. I'm facing problem .. it won't receive any data from 5555 port .. I tried to make it copy the RAW file but it stopped without getting any data .. is that normal ??

Did you try without using su command? Also where is busybox installed? /system/bin or /system/xbin?

 

[efrant]

I have a question. Let's say we don't want somebody to ever use this guide to recover our stuff after we sell them a phone. What's the most secure and thorough way to destroy all data on the Gnex, making it impossible to recover, short of destroying the phone?

If you use the erase command in fastboot, it should work (i.e., "fastboot erase userdata"), otherwise, flashing the stock userdata image will do the trick (i.e., "fastboot flash userdata userdata.img") <-- this writes a blank image in the userdata partition.

 

[Wartickler]

...well, that's a good question!

I have a question. Let's say we don't want somebody to ever use this guide to recover our stuff after we sell them a phone. What's the most secure and thorough way to destroy all data on the Gnex, making it impossible to recover, short of destroying the phone?

I would imagine you could do this guide, use a Guttman algorithm wipe utility on the attached VHD and then figure out a way to push the entire VHD back to the phone. Unfortunately, that may not actually overlay the physical phone memory in the same way. Perhaps you could wipe the VHD again and push it again, and then again...?

I want to say that someone asked the question on scandiun's post too. Go see if they figured out how to push back to the phone.

Good luck

 

[hetunandu]

Did you try without using su command? Also where is busybox installed? /system/bin or /system/xbin?

busy box installed properly in the right directory

su command used

 

[scandiun]

Sir .. I'm facing problem .. it won't receive any data from 5555 port .. I tried to make it copy the RAW file but it stopped without getting any data .. is that normal ?? see the picture attached

busy box installed properly in the right directory

su command used

When running su check on phone that permissions are granted. Furthermore using absolute paths is for when you are running it from clockworkmod recovery. If the phone is powered on you can use

adb forward tcp:5555 tcp:5555
adb shell
su
nc -l -p 5555 -e dd if=/dev/block/mmcblk0p12

Open another Cygwin terminal and enter:

adb forward tcp:5555 tcp:5555
cd /nexus
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw

If you are still having problems you can try the command within the phone only and see if dd works:

adb shell
su
dd if=/dev/block/mmcblk0p10 of=/dev/null

Also, make sure you run all the commands in the two terminals each time and in the proper order, if you are not sure cancel with Control+C and close them and restart again.

For those who want to try backing up the partition via wifi, you can send it via ftp. Read this post:
http://forum.xda-developers.com/showthread.php?p=27793062#post27793062

 

[Wartickler]

Don't use su...?

busy box installed properly in the right directory

su command used

Please try no su exactly as in the first post.

Did you follow the steps exactly? I can only say they worked for me ):

What phone do you have?