Recovering data from an Android device using dd

Tags: 

There are plenty of tools available to recover files using Windows or Linux... but for Android the apps are very limited:

  • Undelete for Root Users only works with FAT partitions (normally found on SD cards, or some older phones' internal storage)
  • Disk Digger only works to find images and videos (filetypes JPG, PNG, and MP4)

If you've deleted some files from an SD card, the best solution is to take the card out and use a computer to recover your files.

If you need to recover some files from an internal FAT partition, then you can generally mount these partitions through USB (and again - use a computer to recover your files)... or feel free to try the apps above.

BUT - if you've lost files from an internal EXT partition - such as the /data partition, or the internal storage of a Nexus device - you're out of luck, right? Fortunately not! (NOTE: requires root!)


So, let's get started - I'm using Linux, but if you want to use Windows that's fine (just use Cygwin instead of Terminal)...

1. Identify the partition you want to recover files from

The method for this differs slightly from one device to the next... the instructions here are for a Nexus 7, but it shouldn't be too difficult to generalise this to your own device.

  1. First enable ADB on your device (in the developer options) and make sure root is enabled for ADB
  2. Open a terminal window and run adb shell
  3. ​Run su
  4. Run cat /proc/partitions
    • This should give you an output something like:
      179        0    7467008 mmcblk0
      179        1      12288 mmcblk0p1
      179        2       8192 mmcblk0p2
      179        3     665600 mmcblk0p3
      179        4     453632 mmcblk0p4
      179        5        512 mmcblk0p5
      179        6      10240 mmcblk0p6
      179        7       5120 mmcblk0p7
      179        8        512 mmcblk0p8
      179        9    6302720 mmcblk0p9
      179       32       2048 mmcblk0boot1
      179       16       2048 mmcblk0boot0
    • In this case, I want the internal storage - the biggest partition (mmcblk0p9).
  5. If you want a different partition than internal storage, or if it isn't obvious which that is, then you can try running something like ls -l /dev/block/platform/sdhci-tegra.3/by-name/
    • On a Tegra3 device, this should give a list of partitions, with a name assigned to each (e.g. APP -> /dev/block/mmcblk0p3, and UDA -> /dev/block/mmcblk0p9).
    • UDA stands for "user data area" and will probably be what you are looking for!

2. Copy the contents of this partition to your computer

Now we've worked out which partition contained our deleted files, we need to make a complete copy of the partition - so we can try to recover the files on our computer. This requires adb, nc, and pv (for Windows users, netcat is found here, and pv is in the Cygwin repos).

  1. Open a terminal window and run adb forward tcp:5555 tcp:5555
  2. Run adb shell
  3. Run su
  4. Run busybox nc -l -p 5555 -e busybox dd if=/dev/block/mmcblk0p9 (replace this with your partition)
  5. Open another terminal window and run adb forward tcp:5555 tcp:5555
  6. Run nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p9.img

This will take a long time if you are copying a large partition! (It took almost 2 hours to copy a 13.5GB "internal storage" partition from my Nexus 7!)

3a. (Hopefully) recover the files! [Linux]

  1. We can mount the partition directly in Linux, using a loop device... make a directory to mount the partition inside, e.g. mkdir nexus7 (or whatever you want!)
  2. Run sudo mount -o loop,ro,noexec,noload mmcblk0p9.img nexus7 (changing the .img and directory names to match your own)
  3. Use your recovery tool of choice, e.g.
    • extundelete
    • scalpel
    • foremost

And hopefully you will be able to find the file(s) you wanted!