Use FreeBSD to mount Android root (or data) dir. to recover data ?

Perceval · Friday at 2:16 PM

Hi all !
few days ago, I made a mystake, I deleted a SMS/MMS chat with my wife (this was a years++ one, so it eventually crashed before delteing everything but it had removed all the MMS attachments) and now, I try to recover the MMS pictures that were deleted. They are stored (if I remember) in /data/user_de/0/com.android.providers.telephony/app_parts.
The idea (it's an idea only, not sure how/if it works) would be to mount this directory, then run Testdisk to show and recover "to be deleted" hidden files.

My phone has full root access, I can adb and shell (including sudo) with no issue. Sadly, everything I tried so far didn't do it because mtpfs and misc Android or computer recovery applications only scan for sdcard folder.

Does anyone know something to do to show and recover, Testdisk like, this specific directory ? (Or a better idea than mine of course... For instance, I did not try to mount the directory using FTP, then mountpoint, to run Testdisk or somethign else on it...!)

I've some backups from about 2 years ago, and my wife has the attachements too (but in low quality), so It'd be great anyway to recover stuff from my side...

Any idea welcome as usual

tingo · Friday at 7:00 PM

wouldn't it be better to use adb to create a copy (backup) of your phone, then make a copy of that to run Testdisk (and any other recovery programs you want to try) on?

Perceval · Friday at 9:26 PM

Thanks !
The problem is that the files were deleted, or probably tagged to trim (If I remember how these storages work). Would a backup also copy these hidden/not to be used anymore files...? I'm not sure.
Maybe a dd would do it, that would create a full raw dump of the directory...?

astyle · Friday at 11:26 PM

If your phone is rooted:
1. Does it have an SSH client installed?
2. Can you ping another computer by IP?

The answer to both should be yes if you have busybox installed (essential to do when rooting a phone!)

If you know of a hidden directory on your phone where the 'deleted' files actually live, you can cd into that directory, and try to recover your files like this:

Code:

scp -r ./my_deleted_file user@remote_ip_address:/path/to/recovery/directory

This idea assumes that you have a UNIX machine (with remote_ip_address) that you can SSH into.

But frankly, XDA Forums (https://xdaforums.com/) would be a better bet than FreeBSD Forums for this kind of question.

Espionage724 · Saturday at 6:14 AM

Perceval said:
Does anyone know something to do to show and recover, Testdisk like, this specific directory ? (Or a better idea than mine of course... For instance, I did not try to mount the directory using FTP, then mountpoint, to run Testdisk or somethign else on it...!)

adb pull might be useful (pulls files over adb without MTP), and general Linux commands like ls can be used to look for files. On my phone I can boot to LineageOS's recovery, enable adb, and also look through files.

Some phone chipsets allow for dumping partitions as-is, but I'm thinking ext4 encryption might make this tricky (I haven't read anything about mounting encrypted Android partitions). For Qualcomm there's EDL mode.

Perceval · Saturday at 11:06 AM

Thanks for your help !
astyle : yes, I can run SSH from the terminal emulator, and yes I can ping with no problem anything on the network

I'd say that the files are in the directory from where they were deleted (so, /data/user_de/0/com.android.providers.telephony/app_parts), that's actually the way I saw this on SSD drives so it should be the same. But I don't know their names (I might get them individually from the mmssms.db but I think the urls were also deleted at first with their relative files). I was trying to use Testdisk because it also lists deleted files from a directory - in fact, I should say, files that are attributed for deletion but not effectively deleted yet by the automated TRIM command.

@Espionnage724 : adb pull should not display these famous deleted/but not deleted files... That's how it was designed, it's not shocking, it is not supposed to display a whole list of garbage data

Indeed, XDA would be better, but I was curious if FreeBSD would do a miracle

Thanks very much for your ideas, I'll give a try. Too bad that I simply can't mount this specific directory to dig in it...!

astyle · Saturday at 2:55 PM

Perceval said:
Too bad that I simply can't mount this specific directory to dig in it...!

Are you saying that you can't use your phone's Terminal app to cd into that directory or try to mount it? Typing may be awkward on a phone, but it very well could be what saves your files.

IIRC, Android does have a 'Trash' directory, you might try looking there.

Perceval · Saturday at 6:12 PM

Well, from the phone I can go easily into this directory, browse/edit or copy anything, very easy using Root Explorer too. But it will not show the deleted files... That's why I try (if possible, of course) to mount the directory on another computer (ie get Android /data mount into BSD /mnt/mydir) to run the tools to check for deleted files, if they still exist btw. But since it's /data directory and not the usual locations (/sdcard), nothing look to work, because you're not supposed to mount / or anything else than the /sdcard (userspace)

but it's pretty stupid, such data should be in the userspace, not lost into another directory...
I've been trying to look for a trash dir, but no luck. Internet simply says blah blah Google/Samsung/misc trash, where I'm only using clean FOSS software, including a self cleaned version of LineageOS.
Would you have any idea of where could this trash be ?

astyle · Saturday at 9:46 PM

Perceval said:
Well, from the phone I can go easily into this directory, browse/edit or copy anything, very easy using Root Explorer too. But it will not show the deleted files... That's why I try (if possible, of course) to mount the directory on another computer (ie get Android /data mount into BSD /mnt/mydir) to run the tools to check for deleted files, if they still exist btw. But since it's /data directory and not the usual locations (/sdcard), nothing look to work, because you're not supposed to mount / or anything else than the /sdcard (userspace) but it's pretty stupid, such data should be in the userspace, not lost into another directory...
I've been trying to look for a trash dir, but no luck. Internet simply says blah blah Google/Samsung/misc trash, where I'm only using clean FOSS software, including a self cleaned version of LineageOS.
Would you have any idea of where could this trash be ?

I'd first look using a filemanager app, and then find the corresponding directory with commandline. In commandline, it will show as a long, convoluted path like what you quoted in Opening Post: /data/user_de/0/com.android.providers.telephony/app_parts... I think you'll be surprised at the correlation between 'Trash' in an app and the actual filepath on the phone's storage.

Perceval · Sunday at 8:28 PM

astyle said:
I'd first look using a filemanager app, and then find the corresponding directory with commandline. In commandline, it will show as a long, convoluted path like what you quoted in Opening Post: /data/user_de/0/com.android.providers.telephony/app_parts... I think you'll be surprised at the correlation between 'Trash' in an app and the actual filepath on the phone's storage.

I'm going to dig this

thanks very much !!
If I find something new, I'll update.