Project

General

Profile

replicant recovery

Added by s s about 2 months ago

what is the process to recover a deleted file in replicant?

second question, can files be recovered even if the phone is wiped through recovery?

third question, if stock firmware has been flashed over to replace replicant, can anything from the previous replicant installation be recovered?


Replies (4)

RE: replicant recovery - Added by Andrés D about 2 months ago

s s wrote:

what is the process to recover a deleted file in replicant?

My advice is not to try recovering inside Replicant. If it was deleted from an sdcard: shutdown the phone, remove the sdcard and use an undeleting tool from a Linux or Windows computer. If it was deleted from the internal mmc flash, dump the partition to a Linux computer:

$ adb exec-out dd if=/dev/block/bootdevice/by-name/userdata > data.img

and again use undeleting tools there.

second question, can files be recovered even if the phone is wiped through recovery?

Afaik, wiping usually recreates the filesystem without overwriting anything except the filesystem structures, so depending on the tool it could be possible to recover some data.

third question, if stock firmware has been flashed over to replace replicant, can anything from the previous replicant installation be recovered?

Writing data again to a partition, even if not reformated, greatly increases the chance of destroying the data. That's the main reason why I recommend extracting the data to a computer and then recover it there, because installing tools to the phone increases the chance of overwriting.

Andrés

RE: replicant recovery - Added by s s about 2 months ago

the scenario is the phone was encrypted with a password on replicant then stock firmware was installed and the file was on internal memory.

the file was in pictures folder

now the phone also has twrp recovery, so can you please tell me what are the steps to be taken in order please including how to decrypt the recovered image?

RE: replicant recovery - Added by s s 18 days ago

can someone help with this and read my message before last

and please explain how to recover an encypted phone while knowing the password

RE: replicant recovery - Added by Andrés D 16 days ago

s s wrote:

can someone [...] explain how to recover an encypted phone while knowing the password

The internal storage is hold in partitions of the physical storage devices (like emmc, sata etc.), for example: /dev/block/mmcblk0p1 (first partition of mmcblk0 device).
Filesystems are mounted from block devices, but not always on partitions of physical storage devices. For example, your /data filesystem can be mounted from an encrypted block device like /dev/block/md-0 (behind the magic it will reside encrypted in a physical partition, like /dev/block/mmcblok0p1). That device (md-0) is a virtual one, after enabling it with the password, when you read from it you get unencrypted data.

The steps to recover data from an encrypted block device (exactly the same if it's not encrypted):

- Know in which directory your lost data resided: for example /data/.../Pictures/

- Get the block device in which that filesystem resides. From a root terminal in the phone do # mount, and you will get something like:

/data on /dev/block/md-0

- With adb as root copy the block device (/dev/block/md-0) as if it were a normal file to your computer.

- In your computer use regular Linux tools to recover files from a filesystem inside an image (the file you copied).

I have never done this process, but I think that it should work. And finally the best advice: backup your data regularly.

    (1-4/4)