1

A relative of mine accidentally deleted the "DCIM/Camera" folder with all her photos, and asked me if it's possible to recover them.

I copied the 'userdata' partition (ext4) to a VHD image at once and tried to recover the files (Recuva, R-Studio, Photorec, DiskDrill, DiskDigger, DiskGenius, etc., were used but to no avail). Nearly all the photos were of 0 bytes in size, like they were securely deleted.

Several years ago I encountered a similar issue (the photos just vanished, I believe it was some SD card issue) and recovered files were 0 bytes in size too.

Is there any way to recover the files?

Unfortunately, sync with Google Photos cloud was not set up as well.

Edit: this is how I pulled the image:

  1. Installed BusyBox in the phone;

  2. Installed Filezilla Server on desktop. Settings: listen on those ports: 40, all timeout settings: 0, create new user ("user", "pass") and give him rights for the chosen shared folder ("read write delete" for files and "list + subdirs" for folders);

  3. Disabled Windows firewall;

  4. Checked adb (adb devices);

  5. Enabled USB tethering, got the new desktop IP via ipconfig (192.168.42.79);

  6. Found the userdata partition (mmcblk0p17):

    adb shell
cat /proc/emmc | grep userdata

  7. Pulled the dump: 

    adb shell
su
mkfifo /cache/myfifo ftpput -v -u user -p pass -P 40 192.168.42.79 mmcblk0p17.raw /cache/myfifo

    And then:

    adb shell
su
dd if=/dev/block/mmcblk0p17 of=/cache/myfifo
  8. Voila! We've got a 27 GB mmcblk0p17.raw image.
Firelord
  • 25,084
  • 20
  • 124
  • 286
FelisManulus
  • 111
  • 1
  • 3
  • 1
    Not sure how you copied the "userdata" partition unless you have TWRP or an unlocked bootloader, nor did you state your device. If you are trying to access a partition or directly to the "disk" via USB, that hasn't been possible since prior to Android 5.0 and only MTP access is available, which is accessing a database of files and using the OS to transfer then with a different protocol, you can't access the DB directly. Assuming you did pull a good image with dd or similar tool, and those tools or testdisk under Linux found nothing or just zero byte files, unfortunately they are just lost. – acejavelin Dec 05 '18 at 02:00
  • Yes the ext4 image seems to be pretty good, I even managed to restore 4 photos out of several hundred, and all other files were intact. I tried testdisk as well (so called PhotoRec). – FelisManulus Dec 05 '18 at 04:25
  • 1
    How to recover a deleted file from /data partition? – Irfan Latif Dec 14 '19 at 21:14

0 Answers0