[GUIDE] Internal Memory Data Recovery - Yes We Can!

Search This thread

Wartickler

Senior Member
Nov 4, 2009
170
353
103
Tallahassee, FL
Go to my post on page 18, post 176. You won't have to wipe anything, though incur the same writes to your phone when installing Busybox and pushing the root.

Not sure about "adb backup" - either what it is or what will occur.
Hi. n00b here.

I accidentally deleted picture files on my Galaxy Nexus JOP40C which I would like to recover. However, until now I never knew anything about bootloaders or root access, so the recommendation by you, efrant, on another thread was to use these instructions to recover everything.

My question is- Assuming I run adb backup, what will happen when I unlock the bootloader (wiping everything) and root the phone (wiping everything) and then restore? Will ALREADY DELETED files appear during the 'restore' with the files that were wiped as a result of unlocking/rooting? Or do you think only current files will save to adb backup for later restoration?

Thanks for the help.

According to jcarmi04's post 176 there should be a way to unlock without actually having it wipe your device.

Sent from my Galaxy Nexus Toro that is way better than yours [see also: "Mmuzzy"]
 

TechGuyDev

Member
Feb 4, 2013
47
7
0
Puri
Thanx

The Preamble
Did you delete all your SDCard data? :confused:
Are you pissed because no one told you before you unlocked your bootloader what would happen? :eek:
Did you lose valuable pictures of cats doing wondrously funny things? :laugh:
Well now there's a convenient new way for you to get that data back Buckaroo! :cowboy:

The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But, cry no more cream-puff! :crying:

The Process
My phone is the Samsung Galaxy Nexus (toro) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
  • back up the entire internal memory partition to your computer as a single, massive .RAW file,
  • convert the .RAW file output to a VHD,
  • mount the VHD as a disk in Disk Manager,
  • scan the attached VHD volume for files that have been deleted and recover them,
  • ?
  • profit! :good:

The Requirements
  • A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
  • BusyBox installed on your device,
  • Cygwin installed to [c:\cygwin] with pv and util-linux from the repo. Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\nexus] to put the exported .RAW file,
  • Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
  • ADB (make sure adb.exe is in your path),
  • USB Debugging enabled on your device,
  • VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\nexus],
  • Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
  • A calm sense of peace and serenity that you will get your files back... :fingers-crossed:

The Work
  1. Identify which block/partition you want to recover. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p12
  2. Turn on your phone
  3. Connect the phone in ADB mode
  4. Unlock the screen.
  5. Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
    Code:
    adb forward tcp:5555 tcp:5555
    adb shell
    /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12
  6. Open another Cygwin terminal and enter:
    Code:
    adb forward tcp:5555 tcp:5555
    cd /nexus
    nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
  7. Run around the house a few times. For 32GB internal memory this is going to take 3+ hours. That's a lot of running. When it's done...
  8. We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\nexus], and type:
    Code:
    VhdTool.exe /convert mmcblk0p12.raw
  9. Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
  10. Select Storage-->Disk Management.
  11. In the menu select Action-->Attach VHD.
  12. For Location enter [c:\cygwin\nexus\mmcblk0p12.raw] and select the OK button.
  13. Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
  14. Select the GPT (GUID Partition Table) radio button and select the OK button.
  15. Right-click on the Unallocated space and select New Simple Volume...
  16. In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
  17. A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
  18. Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
  19. A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
  20. Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
  21. The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
  22. ?
  23. Profit! :victory:

The Appendix
The following links helped me to create this modern marvel - mad props to scandiun! :

Good luck!

Nice post i will try at my best ... :cowboy:
 
  • Like
Reactions: sachin_madan

capt.nizam

Member
Oct 3, 2012
11
39
0
Chennai
Thanks

The Preamble
Did you delete all your SDCard data? :confused:
Are you pissed because no one told you before you unlocked your bootloader what would happen? :eek:
Did you lose valuable pictures of cats doing wondrously funny things? :laugh:
Well now there's a convenient new way for you to get that data back Buckaroo! :cowboy:

The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But, cry no more cream-puff! :crying:

The Process
My phone is the Samsung Galaxy Nexus (toro) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
  • back up the entire internal memory partition to your computer as a single, massive .RAW file,
  • convert the .RAW file output to a VHD,
  • mount the VHD as a disk in Disk Manager,
  • scan the attached VHD volume for files that have been deleted and recover them,
  • ?
  • profit! :good:

The Requirements
  • A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
  • BusyBox installed on your device,
  • Cygwin installed to [c:\cygwin] with pv and util-linux from the repo. Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\nexus] to put the exported .RAW file,
  • Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
  • ADB (make sure adb.exe is in your path),
  • USB Debugging enabled on your device,
  • VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\nexus],
  • Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
  • A calm sense of peace and serenity that you will get your files back... :fingers-crossed:

The Work
  1. Identify which block/partition you want to recover. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p12
  2. Turn on your phone
  3. Connect the phone in ADB mode
  4. Unlock the screen.
  5. Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
    Code:
    adb forward tcp:5555 tcp:5555
    adb shell
    /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12
  6. Open another Cygwin terminal and enter:
    Code:
    adb forward tcp:5555 tcp:5555
    cd /nexus
    nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
  7. Run around the house a few times. For 32GB internal memory this is going to take 3+ hours. That's a lot of running. When it's done...
  8. We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\nexus], and type:
    Code:
    VhdTool.exe /convert mmcblk0p12.raw
  9. Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
  10. Select Storage-->Disk Management.
  11. In the menu select Action-->Attach VHD.
  12. For Location enter [c:\cygwin\nexus\mmcblk0p12.raw] and select the OK button.
  13. Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
  14. Select the GPT (GUID Partition Table) radio button and select the OK button.
  15. Right-click on the Unallocated space and select New Simple Volume...
  16. In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
  17. A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
  18. Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
  19. A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
  20. Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
  21. The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
  22. ?
  23. Profit! :victory:

The Appendix
The following links helped me to create this modern marvel - mad props to scandiun! :

Good luck!




Thanks a lotttt works flawles on my note 2

For Note 2 User or any other Android used need to recover look at this thread - > http://forum.xda-developers.com/showthread.php?t=2140410
 
Last edited:
  • Like
Reactions: sachin_madan

sachin_madan

Member
Feb 10, 2013
6
1
0
Stuck at Step 6

not working for my Galaxy S3,
did everything step by step but stuck at step 6,
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p15.raw
* *0 B 0:00:00 [ * 0 B/s] [<=>*
as soon as i hit enter, the process is over ....returns nothing, 0KB Raw file.......please help
 
Last edited:

anirudhks

Senior Member
May 7, 2009
1,205
1,079
0
not working for my Galaxy S3,
did everything step by step but stuck at step 6,
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p15.raw
* *0 B 0:00:00 [ * 0 B/s] [<=>*
as soon as i hit enter, the process is over ....returns nothing, 0KB Raw file.......please help

After you run a dB shell make sure you run such command . And then the nc command..
 

sachin_madan

Member
Feb 10, 2013
6
1
0
First run the adb forward command as step 1 then run adb shell ªâ step 2 on step 3 run su. You will get a pop up on phone as allow root .. click grant and continue with the nc command step

I did the same infact, ran the superuser command and granted permission on my S3 and then the NC command,
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p15.raw
* *0 B 0:00:00 [ * 0 B/s] [<=>*
this is after that only....

Is the memory block same for S3 Jelly bean (4.1.2)??
 
Last edited:

acruz2446

New member
Nov 19, 2010
2
0
0
34
Middletown, Ny
The Preamble
Did you delete all your SDCard data? :confused:
Are you pissed because no one told you before you unlocked your bootloader what would happen? :eek:
Did you lose valuable pictures of cats doing wondrously funny things? :laugh:
Well now there's a convenient new way for you to get that data back Buckaroo! :cowboy:

The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But, cry no more cream-puff! :crying:

The Process
My phone is the Samsung Galaxy Nexus (toro) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
  • back up the entire internal memory partition to your computer as a single, massive .RAW file,
  • convert the .RAW file output to a VHD,
  • mount the VHD as a disk in Disk Manager,
  • scan the attached VHD volume for files that have been deleted and recover them,
  • ?
  • profit! :good:

The Requirements
  • A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
  • BusyBox installed on your device,
  • Cygwin installed to [c:\cygwin] with pv and util-linux from the repo. Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\nexus] to put the exported .RAW file,
  • Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
  • ADB (make sure adb.exe is in your path),
  • USB Debugging enabled on your device,
  • VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\nexus],
  • Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
  • A calm sense of peace and serenity that you will get your files back... :fingers-crossed:

The Work
  1. Identify which block/partition you want to recover. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p12
  2. Turn on your phone
  3. Connect the phone in ADB mode
  4. Unlock the screen.
  5. Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
    Code:
    adb forward tcp:5555 tcp:5555
    adb shell
    /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12
  6. Open another Cygwin terminal and enter:
    Code:
    adb forward tcp:5555 tcp:5555
    cd /nexus
    nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
  7. Run around the house a few times. For 32GB internal memory this is going to take 3+ hours. That's a lot of running. When it's done...
  8. We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\nexus], and type:
    Code:
    VhdTool.exe /convert mmcblk0p12.raw
  9. Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
  10. Select Storage-->Disk Management.
  11. In the menu select Action-->Attach VHD.
  12. For Location enter [c:\cygwin\nexus\mmcblk0p12.raw] and select the OK button.
  13. Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
  14. Select the GPT (GUID Partition Table) radio button and select the OK button.
  15. Right-click on the Unallocated space and select New Simple Volume...
  16. In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
  17. A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
  18. Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
  19. A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
  20. Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
  21. The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
  22. ?
  23. Profit! :victory:

The Appendix
The following links helped me to create this modern marvel - mad props to scandiun! :

Good luck!


i am having trouble on where to put the adb.exe i put it in the orgin path of the c:/cygwin and in the c:adb [path but when i poen the terminal i get the message


bash:adb: command not found, how would i fix this issue?
 

sachin_madan

Member
Feb 10, 2013
6
1
0
I did the same infact, ran the superuser command and granted permission on my S3 and then the NC command,
nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p15.raw
* *0 B 0:00:00 [ * 0 B/s] [<=>*
this is after that only....

Is the memory block same for S3 Jelly bean (4.1.2)??

Also, i checked the mmcblk files at dev/block in my S3, there is no block with name of mmcblk0p15......
mmcblk0p12 is there and i tried all the steps with mmcblk0p12.raw, but the same result
 

sachin_madan

Member
Feb 10, 2013
6
1
0
Also, i checked the mmcblk files at dev/block in my S3, there is no block with name of mmcblk0p15......
mmcblk0p12 is there and i tried all the steps with mmcblk0p12.raw, but the same result

Hey,
tried adb shell mount and found that mmcblk0p12 is my S3 data partition....
tried a couple of times and BINGO, its finally running........
will try to finish the process now......:)
 
  • Like
Reactions: scandiun

sachin_madan

Member
Feb 10, 2013
6
1
0
The Preamble
Did you delete all your SDCard data? :confused:
Are you pissed because no one told you before you unlocked your bootloader what would happen? :eek:
Did you lose valuable pictures of cats doing wondrously funny things? :laugh:
Well now there's a convenient new way for you to get that data back Buckaroo! :cowboy:

The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But, cry no more cream-puff! :crying:

The Process
My phone is the Samsung Galaxy Nexus (toro) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
  • back up the entire internal memory partition to your computer as a single, massive .RAW file,
  • convert the .RAW file output to a VHD,
  • mount the VHD as a disk in Disk Manager,
  • scan the attached VHD volume for files that have been deleted and recover them,
  • ?
  • profit! :good:

The Requirements
  • A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
  • BusyBox installed on your device,
  • Cygwin installed to [c:\cygwin] with pv and util-linux from the repo. Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\nexus] to put the exported .RAW file,
  • Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
  • ADB (make sure adb.exe is in your path),
  • USB Debugging enabled on your device,
  • VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\nexus],
  • Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
  • A calm sense of peace and serenity that you will get your files back... :fingers-crossed:

The Work
  1. Identify which block/partition you want to recover. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p12
  2. Turn on your phone
  3. Connect the phone in ADB mode
  4. Unlock the screen.
  5. Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
    Code:
    adb forward tcp:5555 tcp:5555
    adb shell
    /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12
  6. Open another Cygwin terminal and enter:
    Code:
    adb forward tcp:5555 tcp:5555
    cd /nexus
    nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
  7. Run around the house a few times. For 32GB internal memory this is going to take 3+ hours. That's a lot of running. When it's done...
  8. We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\nexus], and type:
    Code:
    VhdTool.exe /convert mmcblk0p12.raw
  9. Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
  10. Select Storage-->Disk Management.
  11. In the menu select Action-->Attach VHD.
  12. For Location enter [c:\cygwin\nexus\mmcblk0p12.raw] and select the OK button.
  13. Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
  14. Select the GPT (GUID Partition Table) radio button and select the OK button.
  15. Right-click on the Unallocated space and select New Simple Volume...
  16. In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
  17. A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
  18. Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
  19. A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
  20. Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
  21. The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
  22. ?
  23. Profit! :victory:

The Appendix
The following links helped me to create this modern marvel - mad props to scandiun! :

Good luck!

Hi,
Did everything .....got raw file, run recuva but didnt get even a single lost picture.....:confused: it shows the recoverable pictures even older than ithe one i was looking for, not even a single result for those pictures......
any other way guys????
 

rjkool3

Member
Feb 13, 2013
14
0
0
Stuck trying to transfer

The Preamble
Did you delete all your SDCard data? :confused:
Are you pissed because no one told you before you unlocked your bootloader what would happen? :eek:
Did you lose valuable pictures of cats doing wondrously funny things? :laugh:
Well now there's a convenient new way for you to get that data back Buckaroo! :cowboy:

The Problem
Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But, cry no more cream-puff! :crying:

The Process
My phone is the Samsung Galaxy Nexus (toro) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
  • back up the entire internal memory partition to your computer as a single, massive .RAW file,
  • convert the .RAW file output to a VHD,
  • mount the VHD as a disk in Disk Manager,
  • scan the attached VHD volume for files that have been deleted and recover them,
  • ?
  • profit! :good:

The Requirements
  • A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
  • BusyBox installed on your device,
  • Cygwin installed to [c:\cygwin] with pv and util-linux from the repo. Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\nexus] to put the exported .RAW file,
  • Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
  • ADB (make sure adb.exe is in your path),
  • USB Debugging enabled on your device,
  • VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\nexus],
  • Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
  • A calm sense of peace and serenity that you will get your files back... :fingers-crossed:

The Work
  1. Identify which block/partition you want to recover. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p12
  2. Turn on your phone
  3. Connect the phone in ADB mode
  4. Unlock the screen.
  5. Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
    Code:
    adb forward tcp:5555 tcp:5555
    adb shell
    /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12
  6. Open another Cygwin terminal and enter:
    Code:
    adb forward tcp:5555 tcp:5555
    cd /nexus
    nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
  7. Run around the house a few times. For 32GB internal memory this is going to take 3+ hours. That's a lot of running. When it's done...
  8. We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\nexus], and type:
    Code:
    VhdTool.exe /convert mmcblk0p12.raw
  9. Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
  10. Select Storage-->Disk Management.
  11. In the menu select Action-->Attach VHD.
  12. For Location enter [c:\cygwin\nexus\mmcblk0p12.raw] and select the OK button.
  13. Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
  14. Select the GPT (GUID Partition Table) radio button and select the OK button.
  15. Right-click on the Unallocated space and select New Simple Volume...
  16. In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
  17. A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
  18. Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
  19. A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
  20. Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
  21. The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
  22. ?
  23. Profit! :victory:

The Appendix
The following links helped me to create this modern marvel - mad props to scandiun! :

Good luck!

First I must say THANK YOU for this post. Even though I haven't succeeded yet I see others have and it gives me hope. I have nearly everything working but when I type in the NC command to transfer, the time updates but nothing else. I left if for an hour and still nothing. Then just to see what would happen if I hit keys I hit the tab key and it copied the line, then each time I hit enter after hitting the tab key the first time it begins to copy the data... AKA it appears I have to continually hit the enter key for it to copy data. am I missing something? I did a test run on a 60MB block and it took 4.5 minutes. If I'm right that would mean at this speed the 12GB user data partition would take 15 hours? Any help would be much appreciated. The worst part is it isn't my phone its my brother in laws (who doesn't speak English or know much about computers) and I'm leaving to go home in a day and a half so I'm going to start it running but I'm hoping someone can give me a pointer as to why I need to hit enter to copy the file. (oh and I am using the su command and granting access on the phone, without it I didn't seem to get anything to happen)

Thanks,
 

anirudhks

Senior Member
May 7, 2009
1,205
1,079
0
First I must say THANK YOU for this post. Even though I haven't succeeded yet I see others have and it gives me hope. I have nearly everything working but when I type in the NC command to transfer, the time updates but nothing else. I left if for an hour and still nothing. Then just to see what would happen if I hit keys I hit the tab key and it copied the line, then each time I hit enter after hitting the tab key the first time it begins to copy the data... AKA it appears I have to continually hit the enter key for it to copy data. am I missing something? I did a test run on a 60MB block and it took 4.5 minutes. If I'm right that would mean at this speed the 12GB user data partition would take 15 hours? Any help would be much appreciated. The worst part is it isn't my phone its my brother in laws (who doesn't speak English or know much about computers) and I'm leaving to go home in a day and a half so I'm going to start it running but I'm hoping someone can give me a pointer as to why I need to hit enter to copy the file. (oh and I am using the su command and granting access on the phone, without it I didn't seem to get anything to happen)

Thanks,

Could u give more details about what OS you are using and the hone details ...
 

rjkool3

Member
Feb 13, 2013
14
0
0
details

Could u give more details about what OS you are using and the hone details ...

Sorry I meant to include that. Laptop is win 7 x64 and phone is galaxy s3 running a rooted version of stock ATT system 4.1.1. Baseband I747UCDKL3.

I'm using stock gs usb cable and I was able to copy the one partition. I used the latest version of cygwin and had to install pv manuallt placing the exe in the folder using another post at sourceforge.net/projects/pvforcygwin/files/pv-1.3.4-1/

. Any other info that would be handy?
 

anirudhks

Senior Member
May 7, 2009
1,205
1,079
0
Sorry I meant to include that. Laptop is win 7 x64 and phone is galaxy s3 running a rooted version of stock ATT system 4.1.1. Baseband I747UCDKL3.

I'm using stock gs usb cable and I was able to copy the one partition. I used the latest version of cygwin and had to install pv manuallt placing the exe in the folder using another post at sourceforge.net/projects/pvforcygwin/files/pv-1.3.4-1/

. Any other info that would be handy?


First things first have you logged in as Administrator on the PC ?
Have teh UAC been turned off on the Windows level

The PV and the NC need to be in the bin folder of the cygwin

make sure Antivirus is disabled , most of the times the nc.exe is detected as a virus on the machine ..
 

rjkool3

Member
Feb 13, 2013
14
0
0
Copying very slow

First things first have you logged in as Administrator on the PC ?
Have teh UAC been turned off on the Windows level

The PV and the NC need to be in the bin folder of the cygwin

make sure Antivirus is disabled , most of the times the nc.exe is detected as a virus on the machine ..

Yes the PV and NC are in the bin folder, Antivirus is disabled and the windows UAC were disabled and I am logged in as administrator.

Again thanks for the replies.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 306
    This method does not seem to work on newer phones that apply TRIM or some other type of partition clearing implementation. If anyone has recovered their data on a device newer than Android 4.3 please pm me and let me know.

    The Preamble
    Did you delete all your SDCard data? :confused:
    Are you pissed because no one told you before you unlocked your bootloader what would happen? :eek:
    Did you lose valuable pictures of cats doing wondrously funny things? :laugh:
    Well now there's a convenient new way for you to get that data back Buckaroo! :cowboy:

    The Problem
    Internal Memory doesn't mount as a drive like external memory does. External memory would allow you to use data recovery tools that scan for deleted files and return them to a usable state. These tools work because most operating systems don't go through and set all of those 1's and 0's to just 0's when you delete a file. Usually the operating system will just delete the reference pointer in the index that says that a file exists with such-and-such name and it's located at this position on the hard disk / memory location. There are destructive delete tools out there that will overwrite the spot of a deleted file multiple times to discourage recovery in just this manner. The issue is that data recovery tools need an actual mounted drive in order to dig deep and unearth those funny pictures of cats you so tragically deleted by accident. These newest batches of phones don't have external SDcards which are super easy to mount as drives. Internal memory mounts as MTP/PTP which is not treated as a mounted drive and cannot be scanned by these data recovery tools. But, cry no more cream-puff! :crying:

    The Process
    My phone is the Samsung Galaxy Nexus (toro) though I imagine this should work for ANY phone with Internal Memory. We will be using a Windows 7 machine to:
    • back up the entire internal memory partition to your computer as a single, massive .RAW file,
    • convert the .RAW file output to a VHD,
    • mount the VHD as a disk in Disk Manager,
    • scan the attached VHD volume for files that have been deleted and recover them,
    • ?
    • profit! :good:

    The Requirements
    • A rooted Android phone, (try to root with a non-destructive method as this appears to protect those who must root from wiping the device data a second time),
    • BusyBox installed on your device,
    • Cygwin installed to [c:\cygwin] with pv and util-linux from the repo. Make sure to open Cygwin once to make sure that the /bin folder is created. Also, I made a folder at [c:\cygwin\nexus] to put the exported .RAW file,
    • Netcat (download the ZIP file and extract nc.exe to [c:\cygwin\bin]),
    • ADB (make sure adb.exe is in your path),
    • USB Debugging enabled on your device,
    • VHD tool from the mighty M$. Put the VhdTool.exe file in [c:\cygwin\nexus],
    • Piriform Recuva or your favorite data recovery tool, (it appears Recuva only finds the more common file types like images, videos, etc. Those were the file types in which I was interested. If you are after more exotic file types perhaps you might share the software you used.)
    • A calm sense of peace and serenity that you will get your files back... :fingers-crossed:

    The Work
    1. *****Based on the number of people having trouble with this step it is now my recommendation that you choose to recover your entire memory block instead of just the data partition. In my phone's case that is mmcblk0. Please discover if yours is different.***** Identify which block/partition you want to recover. For our purpose here we are seeking to recover the userdata partition: /dev/block/mmcblk0p12
    2. Turn on your phone
    3. Connect the phone in ADB mode
    4. Unlock the screen.
    5. Open a Cygwin terminal and enter (This assumes your BusyBox installation is at [/system/bin/busybox]. It may be at [/system/xbin/busybox]):
      Code:
      adb forward tcp:5555 tcp:5555
      adb shell
      /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12
    6. Open another Cygwin terminal and enter:
      Code:
      adb forward tcp:5555 tcp:5555
      cd /nexus
      nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
    7. Run around the house a few times. For 32GB internal memory this is going to take 3+ hours. That's a lot of running. When it's done...
    8. We need to convert the .RAW file to a virtual hard drive. VhdTool.exe basically just puts a VHD footer on the end of the .RAW file. Open a Windows command prompt, go to [c:\cygwin\nexus], and type:
      Code:
      VhdTool.exe /convert mmcblk0p12.raw
    9. Now we need to mount the VHD in Windows. Select the Start button-->right-click Computer-->select Manage.
    10. Select Storage-->Disk Management.
    11. In the menu select Action-->Attach VHD.
    12. For Location enter [c:\cygwin\nexus\mmcblk0p12.raw] and select the OK button.
    13. Right-click on the name (e.g. "Disk 1") to the left of the Unallocated space and select Initialize Disk.
    14. Select the GPT (GUID Partition Table) radio button and select the OK button.
    15. Right-click on the Unallocated space and select New Simple Volume...
    16. In the Wizard select Next>, leave the default for the volume size, select Next>, select a drive letter (e.g. K), select Next>, MAKE SURE to select the 'Do not format this volume' radio button, select Next>, select Finish.
    17. A box will pop up asking you to format the drive. You DO NOT want to format the drive at this time.
    18. Right-click on the RAW space and select Format... MAKE SURE to change the File system to FAT32. Set the Allocation unit size dropdown to 'Default.' MAKE SURE that the Perform a quick format checkbox is CHECKED. You do not want to overwrite the entire new drive with all zeroes (0's) and destroy your data. Quick Format means that it will only attempt to destroy the index for the drive by establishing a new index. Without this box checked the Windows operating system will write zeroes (0's) across the entire volume, potentially destroying your data. Select the OK button.
    19. A box will pop up saying that Formatting this volume will erase all data on it. That would be doubly true if you actually didn't check the 'Perform a quick format' checkbox. Double check that you actually did check the box and select the OK button. (Don't worry. This essentially leaves the volume in the exact same state that your phone's internal memory is living in right now: there is data on the drive...you just can't see it. It's coming back, I promise!)
    20. Open the Piriform Recuva application. In the wizard select the 'Next >' button. Select the 'Other' radio button and select Next >. Select the 'In a specific location' radio button and enter: k:\ (assuming K is the drive letter you chose...) Select the Next > button. Select the Enable Deep Scan checkbox. This is the magical setting that finds files that have been deleted...but not really deleted. Select the Start button.
    21. The application may take about an hour to do the 'Deep Scan.' It's time for more laps around the house! Once the application has returned its results you can choose which files to recover using the checkboxes. Select the 'Recover...' button and choose the location to which you wish to output your files.
    22. ?
    23. Profit! :victory:

    The Appendix
    The following links helped me to create this modern marvel - mad props to scandiun! :

    Good luck!
    31
    I forgot to mention, but run commands inside android as superuser or may fail (just after adb shell):

    Code:
    adb forward tcp:5555 tcp:5555
    adb shell
    [B]su[/B]
    /system/bin/busybox nc -l -p 5555 -e /system/bin/busybox dd if=/dev/block/mmcblk0p12

    And greetings for the guide, I didn't know of VHD Tool, congratulations!.
    22
    VHD tool download

    For people who are unable to get hands on VHD tool,

    Exe: https://www.mediafire.com/?f96bmsvjz4qdvbu

    Same thing in zip: https://www.mediafire.com/?f96bmsvjz4qdvbu

    Regards
    15
    Success! Thanks to everybody! :)

    After reading some posts I want to resume in one reply users contribution like advices or notes including my own contribution about "0 byte issue", "cygwin 64 bits vs 32 bits" and other issues of this topic.

    1) Remember that could be important DO NOT use the phone neither Internet neither app which could WRITE at inner memory. The less use, the better.

    2) Remember the possibility to download directly the APK playstore applications from your computer as busybox using an APK downloader instead of downloading directly from your device to prevent write on the inner memory.

    Therefore transfer the APK using USB cable to the external SD card to prevent write data to the inner memory.

    3) Remember that you could have busybox installed in bin, xbin or other folder applying these commands following the steps

    4) Check if ADB shell and busybox have "allow access" in the SuperSU at your phone
    5) Check if the phone is screen blocked with PIN. You need to unblocked it to allow connection between computer and your device
    6) Remember to ACCEPT the RSA fingerprint appear as a popup window on your device when you init the connection using ADB. If this does not appears try to move between USB modes as UTP and PTP till some event trigger it.
    7) It seems NO communication using nc command on cygwin64. Use ncat.exe instead.

    NOTE about "Cygwin 32 bit, instead of the 64 bit" issue: it is not mandatory to install cygwin (32 bits). Using ncat.exe (32 bits) instead of nc at cygwin 64 bits goes on.

    How to install ncat.exe into cygwin64:

    a) Download nmap-6.46-win32.zip from nmap website. Nmap contains ncat.exe application for Windows
    b) Open and extract ZIP file into a temp folder
    c) Copy ncat.exe, libeay32.dll and ssleay32.dll to the C:\cygwin64\bin folder (Assumed you installed cygwin in that path)
    d) Restart cygwin64 terminal to have the changes on.

    Then, change nc to ncat in this step:

    $nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
    $ncat 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw

    8) It is not necessary to log as root inside cygwin. Only run cygwin as Windows Administrator.
    9) Remember to have ADB access at PATH environment var to allow cygwin execute Windows ADB without issues
    10) Remember to use su and absolute paths at first shell.
    $adb shell su /system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0p12

    if it shows the error "can't open permission denied" this means that the device is blocked. See steps 4), 5) and 6)

    11) You will obtain something like that after dump all data from inner memory to the raw file. It is necessary to complete with a non error process:
    ##### gywin first shell ###############

    [email protected]
    $ adb shell su /system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/mmcblk0p12
    24182784+0 records in
    24182784+0 records out

    12381585408 bytes (11.5GB) copied, 2836.886444 seconds, 4.2MB/s
    ###############################

    ##### gywin second shell ############

    $ ncat 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p12.raw
    close: No error [4,21MiB/s] [ <=> ]
    11,5GiB 0:47:17 [4,16MiB/s] [ <=>

    ###############################

    12) Remember to rename mmcblk0p12.raw to mmcblk0p12.vhd AFTER applying vhdtool /convert. Better for recognize VHD files on Windows Disk Management.
    13) AFTER Initialize Disk it is not mandatory create any volume neither quick format the disk although for piriform recuva could be necessary. However some other software as PhotoRec or Diskinternals Partition Recovery are able to READ the Initialized disk and unallocated space to recover files directly. The less manipulation on the VHD, the better.

    14) Remember that the recover utilities have file type defined. But, how about if you want to recover a special file type? In PhotoRec you can define custom file extension to be recovered. More info at cgsecurity.org.

    15) Keep calm and enjoy the process!

    _______________________
    #Computer
    Computer OS Windows 7 64 bits
    CPU Intel Core 2 Duo [email protected]

    #Device
    Model GT-I9300
    Android 4.3
    Baseband I9300XXUGNA8
    Kernel 3.0.31-2429075
    [email protected] #1
    Thu Jan 16 23:47:54 KST 2014
    Build JSS15J.I9300XXUGNA5

    Rooted CF-Auto-Root-m0-m0xx-gti9300.zip
    SuperSU 1.93
    Busybox 1.22.1
    13
    alright. I think I found the solution for the 0 Byte issue.
    I tried everything now and it finally worked.
    The culprit for me was the whole 64 bit thing. Just go 32bit. (Only thing that is 64 bit on my setup is JDK 8 right now.)

    I also want to note that I am on Windows 8 Pro (64bit)

    I quickly want to summarize the important steps where a lot of people seem to make mistakes or oversee something:

    1) get Cygwin 32 bit and NOT 64 bit
    http://cygwin.com/install.html ->> setup x86.exe

    Install it. when Installing click next until you get to the packages window. See screenshot for that . Scroll down to Utils
    add the packages pv and util-linux (by clicking on skip and checking both boxes)
    then complete your installation.

    you should now have a bin folder now.

    2) go grab the adb (adt bundle) from google.
    unzip it and copy the whole content from \adt-bundle-windows-x86_64-20140321\sdk\platform-tools
    to your C:\cygwin\bin folder

    3) grab netcat zip from http://www.daemon.de/Netcat
    and follow their instructions. its only the nc file (nc.exe to be precise) that you want to copy to your cygwin\bin folder

    thats basically it. these are the most important steps where you could have made mistakes.
    for me personally the 64 bit was the only culprit. Everything works fine with the 32 bit cygwin for me. but the 64 bit one still says 0 Bytes.. so scr*w it :)

    also if you want to know your partition, you might have different values like I do. mine was
    Code:
    su
    ls -l/dev/block/platform/dw_mmc/by-name/

    to get your own value type

    Code:
    su
    cd /dev/block/platform/
    ls
    it should output a folder name . the value that you are looking for .

    Code:
    ls -l/dev/block/platform/(ENTER_THE_VALUE_THAT_WAS_OUTPUTTED_BY_THE_LS_CMD_BEFORE)/by-name/

    And that should show you which names are assigned to which patitions (system, user ,data etc)


    And last but not least. I am just an average guy with few skills but I try to punch myself through stuff by learning and trying to do my best.
    I am not trying to brag or convince anybody and I know that there are nerds who might want to bash me. I dont care. I had the 0 byte problem myself and read through the forums and the problem was never really solved.
    Now that I solved it for myself I could ve left without sharing my success in solving this problem (for my case at least but I hope its a general one)
    But I took my time to share it with the guys in need.

    I hope it will help you and many of you have precious data that needs to be restored. I would be happy if I can contribute something to save your pics from family etc and other cases that were mentioned a few times in this thread.

    Also Thanks to the Topic Starter , but I dont recommend the recovery software that he recommend. I'd go for testdisk / photorec personally.
    There was another software that was recommended somewhere in this thread . you might want to test that one maybe if testdisk is too hard for you.

    one last request: I think my post is going to be long. so PLEASE dont quote all of it if you answer :D
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone