Replicant

s s wrote:

what is the process to recover a deleted file in replicant?

My advice is not to try recovering inside Replicant. If it was deleted from an sdcard: shutdown the phone, remove the sdcard and use an undeleting tool from a Linux or Windows computer. If it was deleted from the internal mmc flash, dump the partition to a Linux computer:

$ adb exec-out dd if=/dev/block/bootdevice/by-name/userdata > data.img

and again use undeleting tools there.

second question, can files be recovered even if the phone is wiped through recovery?

Afaik, wiping usually recreates the filesystem without overwriting anything except the filesystem structures, so depending on the tool it could be possible to recover some data.

third question, if stock firmware has been flashed over to replace replicant, can anything from the previous replicant installation be recovered?

Writing data again to a partition, even if not reformated, greatly increases the chance of destroying the data. That's the main reason why I recommend extracting the data to a computer and then recover it there, because installing tools to the phone increases the chance of overwriting.

Andrés

-

-

s s wrote:

can someone [...] explain how to recover an encypted phone while knowing the password

The internal storage is hold in partitions of the physical storage devices (like emmc, sata etc.), for example: /dev/block/mmcblk0p1 (first partition of mmcblk0 device).
Filesystems are mounted from block devices, but not always on partitions of physical storage devices. For example, your /data filesystem can be mounted from an encrypted block device like /dev/block/md-0 (behind the magic it will reside encrypted in a physical partition, like /dev/block/mmcblok0p1). That device (md-0) is a virtual one, after enabling it with the password, when you read from it you get unencrypted data.

The steps to recover data from an encrypted block device (exactly the same if it's not encrypted):

- Know in which directory your lost data resided: for example /data/.../Pictures/

- Get the block device in which that filesystem resides. From a root terminal in the phone do # mount, and you will get something like:

/data on /dev/block/md-0

- With adb as root copy the block device (/dev/block/md-0) as if it were a normal file to your computer.

- In your computer use regular Linux tools to recover files from a filesystem inside an image (the file you copied).

I have never done this process, but I think that it should work. And finally the best advice: backup your data regularly.