Timeline for How to recover a deleted file from /data partition on a rooted phone?
Current License: CC BY-SA 4.0
30 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jun 29, 2024 at 21:57 | comment | added | user1874594 | jumping in the party. So to recover data from /data - dd backup to img file. Mount img fle and use ext4magic or testdisk or similar . Chances of recovery I'd say are scant from microsd card even though that was ext4 similar system like f2fs . Another Q ..if there is a process on Android 12.3x that's deleting /data/sdext2/app/a1 in /data/app/a1 --> /data/sdext2/app/a1 even though chowns are perfect. What is the cause. Why that happens in 12.3x | |
| S Nov 12, 2021 at 7:52 | history | suggested | Matthias Braun | CC BY-SA 4.0 | spelling, wording, grammar |
| Nov 2, 2021 at 9:24 | review | Suggested edits | |||
| S Nov 12, 2021 at 7:52 | |||||
| Apr 13, 2021 at 16:12 | history | bounty awarded | Firelord♦ | ||
| Sep 11, 2020 at 18:45 | history | edited | Irfan Latif | CC BY-SA 4.0 | deleted 553 characters in body |
| Jun 3, 2020 at 17:16 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 141 characters in body |
| Feb 16, 2020 at 2:20 | comment | added | Irfan Latif | @alecxs no. EXT-undelete reads deleted or corrupted data information from the journal of Linux's EXT[N] filesystems. F2FS is not a journaling but log-structured filesystem i.e. roughly saying the whole filesystem is a journal. So the tools developed for one filesystem won't recognize the other at all except the common ioctl's etc. | |
| Feb 15, 2020 at 10:37 | comment | added | alecxs | is extundelete compatible with f2fs? | |
| Dec 14, 2019 at 21:02 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 1912 characters in body |
| Aug 28, 2019 at 11:27 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 108 characters in body |
| Aug 13, 2019 at 12:45 | comment | added | Irfan Latif | @alecxs you are right. Linux mount binary has issues mounting loop file b/c of difference in /dev/loop* and /dev/block/loop*. busybox mount does mknod before LOOP_SET_STATUS if loop device doesn't exist. Linux mount always expects (64) loop devices to exist. | |
| Aug 13, 2019 at 12:04 | comment | added | alecxs | tested without -t and works! However, in my forensic scripts i often got "invalid argument" when just -t was missing, and i made some tests and figured out this happens for loop mounts. on the other hand i did know loop is not necessary for busybox, but necessary for mount binary. Things may have changed meanwhile, or it's a special thing of my old debian | |
| Aug 13, 2019 at 11:46 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 862 characters in body |
| Aug 13, 2019 at 11:16 | comment | added | Irfan Latif | Both also should handle losetup of loopback files automatically (see this and this). Same is true for full mount binary from util-linux. So if filesystem isn't corrupted and mount binary isn't buggy, I don't think -t is necessary. | |
| Aug 13, 2019 at 11:15 | comment | added | Irfan Latif | @alecxs you must be right, though the link you mentioned is a bit outdated. But I never came across such situation that mount couldn't guess filesystem type including ext4, f2fs, ntfs and exfat, either from loop file or block device. busybox mount as well as toybox mount can detect filesystem type. | |
| Aug 13, 2019 at 9:47 | comment | added | alecxs | mount can not detect fstype for loop mounts, especially for dirty mounts (see link) | |
| Aug 13, 2019 at 8:27 | comment | added | Irfan Latif | @alecxs mentioning fstype isn't necessary; mount binary can guess a number of commonly used filesystems. No -t is actually -t auto. adb pull is worth-mentioning. Thanks for pointing out. | |
| Aug 12, 2019 at 17:55 | comment | added | alecxs | you just forgot to tell mount the fstype. use mount with -t ext4 -o loop,ro,noexec,noload and instead of adb exec-out you could just use adb pull /dev/block/bootdevice/by-name/userdata or adb pull /dev/block/dm-0 digital-forensics.sans.org/blog/2011/06/14/… | |
| Aug 6, 2019 at 1:44 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 119 characters in body |
| Jul 8, 2019 at 19:03 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 996 characters in body |
| Apr 16, 2019 at 4:35 | vote | accept | K. Hatake | ||
| Mar 14, 2019 at 18:25 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 267 characters in body |
| Feb 24, 2019 at 10:56 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 240 characters in body |
| Feb 23, 2019 at 7:46 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 959 characters in body |
| Feb 22, 2019 at 7:40 | vote | accept | K. Hatake | ||
| Feb 22, 2019 at 7:40 | |||||
| Feb 21, 2019 at 16:07 | history | edited | Irfan Latif | CC BY-SA 4.0 | added 1 character in body |
| Feb 21, 2019 at 16:02 | history | undeleted | Irfan Latif | ||
| Feb 21, 2019 at 16:01 | history | edited | Irfan Latif | CC BY-SA 4.0 | |
| Feb 21, 2019 at 14:07 | history | deleted | Irfan Latif | via Vote | |
| Feb 21, 2019 at 14:06 | history | answered | Irfan Latif | CC BY-SA 4.0 |