36

I just deleted a file on my Nexus S that I really need back. (It was actually part of an app using a sqlite database that did a drop table when upgrading to a new version.)

Presumably I need to root the phone first (which I hear is easy on Nexus phones) but am I in a catch-22 here? Namely, does rooting the phone mean wiping/overwriting the partition where the data lives?

If not, what do you recommend for data recovery tools? Presumably the file was just unlinked and not actively overwritten (per usual when "deleting" a file) so technically the data must be there...

Improve this question
6
  • I cannot post an answer, the system goes against me. Worse for them... The most easy way when you have Linux system and your device with TWRP recovery is. 0. First of all! Stop creating new files, close all apps. If you will need to run something, better DELETE first some needless files as much as possible to free more space and get more chances to keep your deleted files intact. Of course you will have to know what partition you need to free. High chances its the one that is mounted as /data (your local and deleted files are in /data/media or something like that). Commented May 14, 2019 at 14:37
  • 1. In TWRP recovery copy your partition with dd to micro SD card by 4Gb pieces: ``` dd if=/dev/dm-0 of=/sdcard/x1...n bs=1048576 count=4095 skip=... ``` Well, you have an option to mount external OTG drive (find some external power source though). But mine didn't work, so I had to put pieces to micro-SD. In skip parameter you will put: 0, 4095, 8190, 16380, etc. Commented May 14, 2019 at 14:39
  • 2. Move all pieces to linux system, concatenate with cat. Commented May 14, 2019 at 14:40
  • 3. Use testdisk to recover. This is most versatile tool for extfs undelete. It allows to undel from specific directory and undeletes even broken files and works really fast (apart from heuristic scanners). So you will be sure that everything that is possible is undeleted or overwritten. Commented May 14, 2019 at 14:41
  • Or: always install testdisk as part of busybox bundle and keep it on your phone. Commented May 14, 2019 at 14:47

3 Answers 3

Reset to default
37

Manual way

Luckily data recovery on Android isn't different from any other PC/Linux with a flash storage device. You first need root and the dd binary on your device to make a full backup of the block storage device your deleted file was on. dd is sometimes already installed in your system.

Then it's just 3-steps to find out if the file could be recovered:

  1. Find out on which block device the file was on. Via mount
  2. Acquire and image of that block device with dd: dd if=/dev/<blockdevice> of=/sdcard/image bs=4096
  3. Get a data recovery forensics tool and let it search /sdcard/image for the lost file. You can of course try to run multiple tools on the image. Foremost and Scalpel are a good start.

"Undelete" App

There is a new App called "Undelete Beta" which can recover files on the internal storage and the SD card. The App is beta and has some restrictions.

If the file is really important, I would always choose the "Manual Way".

Improve this answer
6
  • For rooting see this question. I have no Nexus S, but I would say: No, no and sometimes. Commented Nov 21, 2011 at 19:24
  • 1
    @Flow: a) I really wouldn't touch the affected partition any further but unlock the Nexus and 'fastboot boot cwm.img' for a tmp recovery. b) Preferably use adb on the fly to transmit the partition data off the phone (no intermittent storing on /sdcard) using stdout+gzip+uuencode c) carving: sqlite3 has no footer, but a header "SQLite format 3". Using foremost it's best to define a max-size and maybe 'NEXT' (indicating EOF if any other new header is found). OK if I edit? Commented Jul 12, 2012 at 17:33
  • 1
    +1 for 'scalpel'! Haven't known before. BTW: Testdisk's photorec is also quite useful (for standard file types like .jpg ans such) Commented Jul 12, 2012 at 17:37
  • what if the device to backup is bigger than 4gb ? Commented Sep 28, 2013 at 8:16
  • @ce4 the manual method won't work in my case. My android tablet is mounted via mtp So, there isn't any block device on which my android is mounted, rather it's a folder. I can't run dd command then. How to proceed ahead please! Commented Apr 25, 2015 at 14:08
14

As of Android 4.3+ and the implementation of TRIM it is now incredibly difficult to recover deleted files on the internal memory.

Some of the suggested solutions probably will not be worthwhile unless you are able to scan the memory for the deleted file(s) very rapidly after deletion.

Moreover, in the case of recovery after a factory reset, as of Android 4.0+ a factory reset now ends up doing a secure erase (or similar operation) so that all data is irrevocably gone.

Reference:

Improve this answer
1
  • 1
    I assume this is the correct answer in 2019? Commented Nov 3, 2019 at 4:26
8

The new Undelete Beta may be helpful here if you don't want to involve a PC. Any time you write to storage you risk overwriting the deleted file, but rooting shouldn't wipe.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.