3. Recover deleted files on UTouch / Nexus 5

Recover deleted files on UTouch / Nexus 5

  • Z

    Hi,

    I'm trying to recover deleted files from inner memory of my Nexus 5 (deleted during unlocking of device). So far with no luck.

    When phone is connected to PC, it forwards files using MTP, which is virtual file system and no utility on PC can see raw file system behind it.

    I don't know about any recovery app for UTouch.

    I found this solution: http://www.nburles.co.uk/android/recovering-data-from-an-android-device-using-dd, but busybox tool inside UTouch is not in a path and also not compiled with nc (netcat) and dd commands. So it fails on "nc: applet not found". I'm then unable to stream raw file system into file/image through network to PC as guide suggest.

    Does anybody know the way, how to build a busybox with nc and dd for utouch ? I would be marvelous, if it would be just some "option" and could be added to standard image of utouch.

    Also, I don't really know, why should I use busybox in a first place, what does it do? I use following command:

    /usr/lib/initramfs-tools/bin/busybox nc -l -p 5555 -e /usr/lib/initramfs-tools/bin/busybox dd if=/dev/mmcblk0p28/

    So, could it just work with /bin/nc and /bin/dd, ommiting all busybox ?

    I don't really want to break my device (partitions) since I want to recover deleted files.

    Another way would be to install "testdisk" utility on the device, since I used it for SD cards on PC. But I don't know where to get armhf version of a deb package and how to install it in UTouch. Also writing to memory could corrupt my deleted files.

    Thanks for any advice.

    0

  • @zlamalp said in Recover deleted files on UTouch / Nexus 5:

    So, could it just work with /bin/nc and /bin/dd, ommiting all busybox ?

    I would say: just try. The commands read from the phone, so I wouldn't assume it'll break anything.
    The solution is for Android, so I guess it'll be easier (i.e. no need for busybox) for UT because that's a "real" linux.

    0
  • Z

    @ingo said in Recover deleted files on UTouch / Nexus 5:

    I would say: just try. The commands read from the phone, so I wouldn't assume it'll break anything.
    The solution is for Android, so I guess it'll be easier (i.e. no need for busybox) for UT because that's a "real" linux.

    So I tried, but it failed on "broken pipe" error. I probably misunderstood some netcat param (it doesn't have -e param in utouch). But I find out, that I did backed up most of the lost files, so I don't need to investigate this any more. But I guess, that with proper netcat syntax we can use linked solution for android on utouch.

    0

  • I guess the syntax to be used on the phone would be

    dd if=/dev/mmcblk0p28 | nc -l -p 5555

    It reads the entire partition and passes the output to netcat which then transfers it to the PC when the corresponding nc command is launched there.

    0
  • Z

    I tried, but it resulted only in:

    root@ubuntu-phablet:~# /bin/dd if=/dev/mmcblk0p28 | nc -l -p 5555
/bin/dd: writing to 'standard output': Broken pipe
129+0 records in
128+0 records out
65536 bytes (66 kB, 64 KiB) copied, 0.00488971 s, 13.4 MB/s
    0

  • Do you get that error immediately or after some time?
    Have you done the matching commands on the computer side?

    The general syntax should be correct. I've tried a simple setup on my PC

    In terminal 1

    dd if=README.txt | nc -l -p 5555

    In terminal 2

    nc localhost 5555

    And then I saw the contents of README.txt on the "client" side.

    0
    Z
     1 Reply
  • Z

    @ingo said in Recover deleted files on UTouch / Nexus 5:

    Do you get that error immediately or after some time?
    Have you done the matching commands on the computer side?

    It fails almost immediatelly, with random number of records (in/out). I did matching command on the computer side like this:

    nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p28.img

    I didn't test it with a single file. I will try it and with localhost instead of IP too.

    0

  • I now did a full test.

    Terminal 1 (preparation on the PC and commands on the phone)

    ingo@pc:~> adb forward tcp:5555 tcp:5555
ingo@pc:~> adb shell
phablet@ubuntu-phablet:~$ sudo -i
root@ubuntu-phablet:~$ /bin/dd if=/dev/mmcblk0p6 | nc -l -p 5555

    This then waits until I do something on the PC.

    Terminal 2 (connecting to the phone over port 5555 and receiving the partition image)

    ingo@pc:~> nc 127.0.0.1 5555 | pv -i 0.5 > mmcblk0p6.img

    And when I saw 10485760 bytes (10 MB, 10 MiB) copied, 22.2077 s, 472 kB/s in terminal 1 I canceled the command in terminal 2 with ctrl+c.

    I used mmcblk0p6 as an example because that is a 10MB partition for me. Enough for a test but not too much to wait for.

    0
  • Z

    I tried exactly what you posted, but again with "broken pipe" error message. I tried even different (smaller) partitions with same result.

    root@ubuntu-phablet:~# /bin/dd if=/dev/mmcblk0p28 | nc -l -p 5555
/bin/dd: writing to 'standard output': Broken pipe
33+0 records in
32+0 records out
16384 bytes (16 kB, 16 KiB) copied, 0.0672733 s, 244 kB/s
root@ubuntu-phablet:~# /bin/dd if=/dev/mmcblk0p28 | nc -l -p 5555
/bin/dd: writing to 'standard output': Broken pipe
1+0 records in
0+0 records out
0 bytes copied, 0.00068524 s, 0.0 kB/s
root@ubuntu-phablet:~# /bin/dd if=/dev/mmcblk0p28 | nc -l -p 5555
/bin/dd: writing to 'standard output': Broken pipe
1+0 records in
0+0 records out
0 bytes copied, 0.000911716 s, 0.0 kB/s
    0

  • Maybe you can try some very simple test.

    echo Test | nc -l -p 5555
    0
    Z
     1 Reply
  • Z

    Sadly doesn't work, but it exits with 0. I'm not sure but I guess its blocked on the way to the PC for some reason.

    0
Log in to reply