adb – How to recover a deleted file from /data partition?

First to clarify root and data:

  • Root directory / of Android devices is a read-only pseudo (temporary) filesystem (rootfs) that lives in RAM and is vanished when device is powered off. When device is powered on, it’s again extracted from initramfs that lives in boot partition along with kernel.
    On newer devices with system-as-root, system partition is mounted at root /.
  • /data directory is a mountpoint, where largest partition, usually named userdata is mounted. This partition contains all user apps, their data (settings, databases, caches, temporary files etc.), system apps’ data and all other configurations we make through Settings. /data/media/0 is the directory that we see as /sdcard or /storage/emulated/0 through emulation.

… there was a file in the /data directory which I need. Is it possible to create an image (.img or something similar) of the root directory …

If a file is deleted from /data, you need to create a dump of data partition, not that of root directory.

You can do that in multiple ways described below. All require root access.


But first of all see this answer to make sure your data is recoverable.
In short, recovery is more or less possible only if (1):

  • Your deleted data hasn’t been TRIMmed or discarded.
  • And you haven’t done a factory reset on encrypted /data partition.

What you should do immediately:

  • Switch off phone to make sure the deleted dats isn’t overwritten.
  • Don’t install data recovery apps on device, it can do more harm than good.
  • Mount the filesystem (if required) in recovery mode (or on PC) only with ro,nodiscard options.

FINDING BLOCK DEVICE:

In order to access userdata partition, you need to find its block device. If you have root access, you can do so from mounted partitions:

~# mount | grep 'on /data'
/dev/block/mmcblk0p... on /data type f2fs (rw,nosuid,nodev,...)

On Qualcomm devices, it’s located at /dev/block/bootdevice/by-name/userdata (symlink). For MediaTek (MTK) and other SoCs, the path is slightly different. You can find all block devices or by-name directory using find command:

~# find /dev -type b
~# find /dev -type d -name 'by-name'

Or by hit and trial:

~# ls -d /dev/*/by-name
~# ls -d /dev/*/*/by-name
~# ls -d /dev/*/*/*/by-name

Note:

CREATING PARTITION DUMP:

DISK DUMP (dd)
Once the block device is known, you can use dd command from:

  • ADB shell (OS or custom recovery)
  • A terminal emulator app like Termux

Since the userdata partition is the largest partition (all other partitions hardly using 5GB out of total storage), you can’t dump it to your internal memory. An external SD card with larger capacity is needed.

To create dump:

~# dd if=/dev/block/bootdevice/by-name/userdata of=/path/to/ext_sdcard/data.img

ADB
If you don’t want to use external SD card, you can also dump the partition directly to PC. First you need a working adb setup, running as root. Then it can be used in multiple ways:

~$ adb exec-out dd if=/dev/block/bootdevice/by-name/userdata > data.img

* Make sure your adb binary (on Windows or Linux) supports exec-out.

But you may end up with corrupted data when writing a whole large-sized partition to STDOUT of terminal because there are issues with line break types (CR LF). Also STDOUT or STDERR from the programs involved could possibly be added to file if not directed to /dev/null. Even a single wrong byte may render filesystem un-mountable. See this question for reference.
To avoid unwanted characters, use stty raw and/or dos2unix:

~$ adb shell 'stty raw && dd if=/dev/block/bootdevice/by-name/userdata' > data.img

But the most straightforward way is:

~$ adb pull /dev/block/bootdevice/by-name/userdata data.img

See this answer for more details.

STREAM OVER TCP
To avoid the terminal related complications described above or if for some reason adbd cannot be run as root, it’s also possible to create a minimal TCP server for data transfer. Forward port from phone to PC and run netcat TCP server in listening mode:

~$ adb reverse tcp:1024 tcp:1024
~$ nc -v -l -p 1024 </dev/null | pv -ab >data.img

On phone:

~# cat /dev/block/bootdevice/by-name/userdata | busybox nc 127.0.0.1 1024

USB TETHERING (RNDIS)
To avoid using ADB at all, USB tethering can be used to provide network connectivity:

~# cd /sys/class/android_usb/android0
~# echo -n 0 >enable
~# echo -n rndis,adb >functions
~# echo -n 1 >enable

* You may also change other files like {iSerial,iProduct,iManufacturer} and f_rndis/{ethaddr,manufacturer,wceis,rndis_transports,max_pkt_per_xfer} in above directory if required.
* On new devices you might need to use /config interfaces instead of /sys. Some relevant hints here.

Add IP address:

~# busybox ip rule add lookup main
~# busybox ip address add 192.168.1.1/30 dev rndis0
~# busybox ip link set rndis0 up

On PC add IP manually (there’s no DHCP server):

~$ sudo ip address add 192.168.1.2/30 dev usb0
~$ nc -v -l -p 1024 </dev/null | pv -ab >data.img

On phone:

~# busybox nc 192.168.1.2 1024 </dev/block/bootdevice/by-name/userdata

In the same way it’s also possible to use rclone rcat to transfer dump over WebDAV or FTP or SFTP. See How to stream an encrypted backup of the entire device to remote host?

USB MASS STORAGE (UMS)
This method is useful if you don’t want to create a dump of partition, instead access partition directly on PC. See my answer to Why can’t I see Android storage as a partition on PC? for methods on how to enable UMS thorough /sys or /config interfaces.

Once done, userdata will appear as a partition on Linux PC just as we connect a USB drive. If /dev/sda is the hard disk drive, usually /dev/sdb will be the userdata partition. You can find that by using blkid command:

~# blkid | grep userdata
/dev/sdb: PARTLABEL="userdata" PARTUUID="..."

You can run recovery program directly on block device or mount the filesystem (if needed) or may also create a dump.

HOW TO RECOVER DATA?

There are basically two ways to recover deleted data as mentioned in this answer: carving method and through filesystem.

Recovery tools mostly don’t need mounting filesystems but if it’s required, it needs to be done on Linux PC because Windows doesn’t support ext4 or f2fs natively, hence the tools aren’t easily available AFAIK.

If anyone has been able to successfully make block/journal level access to Linux/Android filesystem for data recovery on Windows through Ext3Fsd or any other driver, let me know so that I can update the answer.

On Linux you can use tools like extundelete to recover data using filesystem journal:

~# extundelete --restore-all data.img

Or to recover data directly with UMS:

~# extundelete --restore-all /dev/sdb

Since you have done a factory reset which erases filesystem, consider carving method using tools like testdisk or scalpel:

~# testdisk data.img

In the same way you can use any other data recovery tools. See ArchWiki File Recovery for more details.


RELATED:

google analytics – Summary of e-commerce transactions [deleted sales]

It happens to me that every 24 hours the data of the purchase transactions is erased.
This problem has never happened to me as I have not had the opportunity to track sales on a website.
The website is developed in a CMS [WordPress] has the plugins configured to carry out the monitoring, the code is set correctly, the data is sent correctly to the analytics but we have had the problem that every 24 hours the data is deleted of purchases, the values and the transactions carried out are removed, this does not help us since we need the information to make improvements in the products.
We do not use TAG MANAGER, we follow up directly with ANALYTICS.

If a contact is deleted in Yahoo mail, will it also delete the contact on the android phone’s contact list?

If a phone number is deleted off of yahoo mail, will the number also be deleted off of the android device? If so, can the number reappear automatically or must it be reentered manually to reappear in yahoo mail contact?

Can a publicly shared file stored in my Google Drive be deleted by someone having “Anyone with the link” editor rights?

Short answer. No.
None of the editors having “Anyone with the link” editor rights can delete the file.
The only person who can delete this file is the owner of the file.

You can see that when changing the sharing permissions of a file to Anyone with the link can Edit, the option of changing the settings is greyed out with the message Settings are disabled for public links

enter image description here


Furthermore, when within the file Edit menu , the option of moving the file is greyed out as well.

enter image description here

One can only use the Add a shortcut to Drive.
Even if one later decides to delete this created shortcut from the drive, the original file remains intact.

Conclusion
You can safely, publicly share, any file stored in your Google Drive using “Anyone with the link” editor rights.
Your publicly shared file will never be deleted by anyone else but you.


Important Note
Please do NOT confuse the above with editors added under Share with people and groups.
They CAN delete the file and even deprive you of your rights as the owner.

8 – When old field revisions should be deleted from the database?

I have a question about old fields revisions in Drupal 8. For example I have “Full Title” field in different paragraphs. I have deleted this field from one of the paragraphs, for example from the “Test Paragraph”. In the database there are tables: paragraph__field_section_full_title and paragraph_revision__field_section_full_title. In these tables all of the records for test_paragraph bundle deleted column values changed from 0 to 1.

After the field_cron() that should delete these records all of the records from paragraph__field_section_full_title was deleted as it expected.

But in the paragraph_revision__field_section_full_title table old revisions for test_paragraph bundle whith deleted column = 1 is not deleted. When they should be deleted? Is it automatic process or not? Where I need to look to check if abything broken?

Thanks.

Here screenshot below of the table of not deleted old revisions:

enter image description here

data recovery – Recover deleted chrome bookmarks, saved passwords, etc on android smartphone

My google account wasn’t even logged into google chrome. I was looking to backup my saved bookmarks and passwords and dissociate any such linked data with my google account. I went on to “chrome synced data” page and there it stated that if i clicked on “clear data” it’ll only delete history, bookmarks, passwords, etc. from my google account and not from my device. The fact of the matter is that even if that action could delete stored chrome data on my device, my chrome was not linked to any google account in the first place. I don’t know what happened, i lost 2 year worth of my life’s work in an instant. I really need those passwords and bookmarks. I don’t remember any of them. I’m using an android smartphone running on android 10. Please help me. I’m really desperate and tensed. If you don’t know how to recover them, then atleast guide me how or who should i contact .

data recovery – Recover deleted chrome bookmarks, saved passwords, etc on android smartphone

My google account wasn’t even logged into google chrome. I was looking to backup my saved bookmarks and passwords and dissociate any such linked data with my google account. I went on to “chrome synced data” page and there it stated that if i clicked on “clear data” it’ll only delete history, bookmarks, passwords, etc. from my google account and not from my device. The fact of the matter is that even if that action could delete stored chrome data on my device, my chrome was not linked to any google account in the first place. I don’t know what happened, i lost 2 year worth of my life’s work in an instant. I really need those passwords and bookmarks. I don’t remember any of them. I’m using an android smartphone running on android 10. Please help me. I’m really desperate and tensed. If you don’t know how to recover them, then atleast guide me how or who should i contact .

ios – My iPhone thinks there are 3.5 GB of photos but I literally have no photos there (just deleted everything!)

ios – My iPhone thinks there are 3.5 GB of photos but I literally have no photos there (just deleted everything!) – Ask Different

oracle – RMAN-08120: warning: archived log not deleted, not yet applied by standby

BACKUP DATABASE PLUS ARCHIVELOG DELETE INPUT;

In Data Guard environment this command tries to

1.backup archivelog before starting backup

2.delete archivelog before starting backup

3.backup database

4.backup archivelog generated during backup

5.delete archivelog generated during backup which in most cases these logs couldn’t send or applied to standby database.

If you configure archivelog deletion policy as in the following it couldn’t delete archivelog and shows warning as RMAN-08120: warning: archived log not deleted, not yet applied by standby.
CONFIGURE ARCHIVELOG DELETION POLICY TO APPLIED ON ALL STANDBY;

How to configure backup with only delete archivelog before starting backup, without trying to delete archivelog during generated backup.

How do I delete a user from the master database when the user has been deleted from the Server Logins using the SSMS Object Explorer

I am using an Azure SQL Database. I deleted some users from a Azure SQL database after I saw them mentioned in a Vulnerability Assessment report. Here’s how I deleted them:

  1. Log in to SSMS
  2. Expand the Object Explorer tree
  3. Expand the ‘Security’ folder
  4. Expand the ‘Logins’ folder
  5. Highlight the user
  6. Right-click and select ‘Delete’

I went back to the Vulnerability Assessment blade and ran a new ‘Scan’ but the users I deleted still show up in the list. The list included SQL code to show that my users still exist. I ran that code back in SSMS in the master database and confirmed my users still exist. Here’s the relevant code:

SELECT * FROM sys.database_principals

When I run the following code, I get an error saying the user does not exist (‘or you do not have permission’ – but I am a server admin so I ruled that out):

DROP LOGIN <username>

How do I get rid of these logins?

DreamProxies - Cheapest USA Elite Private Proxies 100 Private Proxies 200 Private Proxies 400 Private Proxies 1000 Private Proxies 2000 Private Proxies ExtraProxies.com - Buy Cheap Private Proxies Buy 50 Private Proxies Buy 100 Private Proxies Buy 200 Private Proxies Buy 500 Private Proxies Buy 1000 Private Proxies Buy 2000 Private Proxies ProxiesLive Proxies-free.com New Proxy Lists Every Day Proxies123