Dump full userdata partition (even deleted files) - Locked bootloader, Marshmallow - G4 Q&A, Help & Troubleshooting

Hello,
I have a friend that accidentally deleted her photos on her LG G4. I don't have a physical access to the phones (she lives far away), but I know this is a H815 on stock Marshmallow, locked bootloader.
While I have some experience in this kind of things, each phone has its particularities... I could:
use DiskDigger, but this requires root access, or
dump the userdata partition (with commands such as dd, cat...), but again, it requires root access.
I'm thinking about rooting the phone while minimizing writing to the userdata, in order to have a minimum loss of deleted pictures.
So I read a few topics on XDA about the LG G4. I saw it's possible to make a full backup in download mode. It it was possible to dump each byte of the partition so I could look for removed pictures, it would be awesome and my probleme would be solved! Or is it only a backup tool (that reads only existing files)? Can someone tell me about this tool?
Another way would be unlocking the bootloader in order to gain root access (for instance via a custom recovery), but it will involve a data wipe I'm afraid I could not recover anything from, if it's a low-level wipe.
I would appreciate any hint
Thanks!

a-m13 said:
Hello,
I have a friend that accidentally deleted her photos on her LG G4. I don't have a physical access to the phones (she lives far away), but I know this is a H815 on stock Marshmallow, locked bootloader.
While I have some experience in this kind of things, each phone has its particularities... I could:
use DiskDigger, but this requires root access, or
dump the userdata partition (with commands such as dd, cat...), but again, it requires root access.
I'm thinking about rooting the phone while minimizing writing to the userdata, in order to have a minimum loss of deleted pictures.
So I read a few topics on XDA about the LG G4. I saw it's possible to make a full backup in download mode. It it was possible to dump each byte of the partition so I could look for removed pictures, it would be awesome and my probleme would be solved! Or is it only a backup tool (that reads only existing files)? Can someone tell me about this tool?
Another way would be unlocking the bootloader in order to gain root access (for instance via a custom recovery), but it will involve a data wipe I'm afraid I could not recover anything from, if it's a low-level wipe.
I would appreciate any hint
Thanks!
Click to expand...
Click to collapse
No root required just check my signature for the DLM backup method
Ensure that you are using the full back-up which also takes care of user data partition
Sent from my LG-H815 using XDA Labs

Related

Question about rooting

I'm trying to root GN but it seems that we MUST unlock bootloader to root.
I know how to do it but just worrying about what will be wipe with unlock, I've just spent whole afternoon setting up this phone and don't want to do it again?
Will I loss:
-Launcher setting? ADW setting?
-Downloaded application? and their setting?
-Do I have to redo all the widget?
I just want to use juicedefender and RE but don't want go through all the trouble again
I think unlocking the boot loader wipes the device. Make a titanium backup first an extract the back up from the sdcard then restore once complete.
dannyfly said:
I'm trying to root GN but it seems that we MUST unlock bootloader to root.
I know how to do it but just worrying about what will be wipe with unlock, I've just spent whole afternoon setting up this phone and don't want to do it again?
Will I loss:
-Launcher setting? ADW setting?
-Downloaded application? and their setting?
-Do I have to redo all the widget?
I just want to use juicedefender and RE but don't want go through all the trouble again
Click to expand...
Click to collapse
As far as I've seen, Google has programmed the device to wipe the /data partition when the unlock command is executed.
This will wipe all application settings including downloaded applications, widgets and the Launcher as they are all stored on the /data partition.
If you dislike this, Google is the place to file the complaint as this is their standard procedure on all their Google "Nexus" devices.
The only upside will be, once you've unlocked, you'll be able to gain root access and be able to have complete control over the device including full backups of all settings to prevent ever having to re-set them again. Unless of course you start flashing lots of custom ROMs which are imcompatible with each other, but that is perhaps another story.
Hope that helps!
mklass said:
I think unlocking the boot loader wipes the device. Make a titanium backup first an extract the back up from the sdcard then restore once complete.
Click to expand...
Click to collapse
I've never used Titantium backup, but many people seem to say a lot of positive things about it. I've also read Titantium backup requires root access.
The Android security structure ONLY allows the root user full unlimited access to the /data partition. Otherwise, each application is assigned a linux UID/GID and only allowed access to their respective directory. According to the Android security structure, no application should be able to access another aplication's directory w/o sharing the same signing key or having root access.
I could be wrong, but I'm definitely certain regarding Android's security structure for "sandboxing" the applications.
Hope that helps clarify!

[Q] Unlock bootloader + root without data wipe?

Is their a method of unlocking the bootloader and rooting the phone (Verizon LTE Version) without losing my data and settings? I want to install cwm and flash a few tweaks but at his point do not want to have to set the phone back up again. Not having root and cwm prevents the back up I need. Is their a way to back up the data partition without root and restore it later after the unlock and root?
You only lose data when you unlock the bootloader and from what I have read you need to unlock the bootloader to get root. You can backup the contents of your /sd card/ so you can backup your app data but I don't think you'll be able to keep system data. If you have a Google account synced it keeps most of this backed up anyway though.
That is the way I understand it as well, was hoping that their would be a better way to do it. I have transferred over 10 gigs of pictures and music t the phone and with mpt it took loooooong time to transfer all that stuff. I know google will restore the apps and some settings like wifi, but then one has to open all the apps you need a log in for and set them up as well.
havent really used MTP much so i dont know whats faster that or transferring over FTP.. maybe that could help you a bit
No. Bootloader unlock = wipe. No questions, no two ways around it.
adb pull /mnt/sdcard *
Back up the whole sdcard partition.

[Q] Full - Full wipe of internal SD card

Hello,
I've done ROM flashes where instructed to perform full wipes through the recovery menu, or while in the OS. But when selling/getting rid of old Android phones (today, specifically speaking of the Note II i317 AT&T) will it make my personal data unrecoverable by methods I've used in the past to recover accidentally deleted photos/documents?
Basically, I don't want to sell my phone and Joe Blow to be able to recover all (or any) of the private pics/sensitive data of said phone (ie steal/sell my identity). How can I go about securely formatting my phone to make that data unrecoverable, yet without bricking the device?
kintamanate said:
Hello,
I've done ROM flashes where instructed to perform full wipes through the recovery menu, or while in the OS. But when selling/getting rid of old Android phones (today, specifically speaking of the Note II i317 AT&T) will it make my personal data unrecoverable by methods I've used in the past to recover accidentally deleted photos/documents?
Basically, I don't want to sell my phone and Joe Blow to be able to recover all (or any) of the private pics/sensitive data of said phone (ie steal/sell my identity). How can I go about securely formatting my phone to make that data unrecoverable, yet without bricking the device?
Click to expand...
Click to collapse
Well, consider a harddrive. It is possible to recover a lot of files after being wiped, and the wipe from the internal recovery doesn't at all (to my knowledge) remove any internal media (files). If of course the recovery doesn't have a added feature to delete partitions i suppose.
And of course, external third part software can recover the files you once deleted, like this: Enter Youtube > search for recover deleted files android. You will find lots of result of how to recover images as a example.
You would need to find a way to unrecoverably delete the files you don't want to share when you sold it, or you could take advantage of the statistics of the fact that quite many people don't know how to recover files.
http://lifehacker.com/5808280/what-should-i-do-with-my-phone-before-i-sell-it
http://www.webroot.com/us/en/home/r...ation/how-to-wipe-your-device-before-donating
http://www.makeuseof.com/tag/how-to-wipe-history-on-android/
Three good sites above..
One good tip was encrypt phone before wiping...

"Encryption Unsuccessful" Boot Loop after installing TWRP.

So I decided to take my first steps to rooting, custom recoveries and ROMs and followed a stickied thread on the OnePlus forums here.
I firstly downgraded from Nougat to Marshmallow using the official Stock ROM. Afterwards, I flashed the recovery.img for TWRP from the official TWRP site. All is good.
I boot into TWRP and it asks me for a decryption password, I enter it and get "Incorrect Password". I try to boot normally and the same thing happens - weird. One member on another forum, from another question, suggested to wipe data through TWRP, and so I did. This cleared the decryption message through TWRP but then I got a boot loop with a simple message of "Decryption Unsuccessful". I press reset and the phone repeats everything.
Anywho, I flashed stock recovery and a fresh Marshmallow ROM which sorted my phone back to safeland.
Question is, how can I bypass all this? I followed the guide to the tee but no mention of this. I'm a n00b to flashing and only really know as far as the instructions on the OnePlus support page for flashing a stock ROM.
Use TWRP 3.0.4-1, it has decryption support.
If you are planning on rooting with SuperSU, use v2.79, not the first one that pops up when you Google "SuperSU". Not sure why, but the first link that pops up on Google directs you to an older version on Chainfire's site, which causes bootloops if you flash it on Nougat.
Other than the versions of the above files, the steps in rooting are the same as in the original guide.
I personally keep my phone decrypted, since I don't have anything super important on it. Not only do I not run into any encryption issues, the phone boots faster is decrypted. Decrypting does have its downsides though (you have to wipe your phone, also less security), so I would recommend that you research about it some more prior to deciding. There are methods of decrypting without losing all data though.
Anova's Origin said:
Use TWRP 3.0.4-1, it has decryption support.
If you are planning on rooting with SuperSU, use v2.79, not the first one that pops up when you Google "SuperSU". Not sure why, but the first link that pops up on Google directs you to an older version on Chainfire's site, which causes bootloops if you flash it on Nougat.
Other than the versions of the above files, the steps in rooting are the same as in the original guide.
I personally keep my phone decrypted, since I don't have anything super important on it. Not only do I not run into any encryption issues, the phone boots faster is decrypted. Decrypting does have its downsides though (you have to wipe your phone, also less security), so I would recommend that you research about it some more prior to deciding. There are methods of decrypting without losing all data though.
Click to expand...
Click to collapse
Thanks for the reply. I agree with you, I'm not fussed about Encryption and would rather have my device decrypted, the problem is I'm not sure how to decrypt it, or if it would be possible to revert and re-encrypt afterwards. As far as I know, Encryption is enabled by default on anything Marshmallow. In addition whether Decrypting would cause further issues down the line.
My reasoning for reverting to Marshmallow was Xposed and is the main reason I'd like to root with the possibility of flashing a new ROM.
In reply to your other points, I used the official TWRP from here if that makes a difference or should I be using the build you provided, surely if I can decrypt my device it makes it pointless for something with decryption support, yes?
Nonetheless, appreciate the reply!
The TWRP build from the official site is a little outdated, it is known to have decryption issues. Try the one from the XDA page.
To decrypt, you have to either root or flash a dm-verity-no-encrypt.zip that is floating somewhere around on XDA, there's probably a copy of it in the root guide in your first post. If you have no data on your phone that you mind losing (after saving a copy somewhere off your phone), the easiest way to decrypt is to go into TWRP and wipe your /data partition. If your phone is rooted or flashed with the no-encrypt.zip, the /data partition will not be encrypted the next time you boot.
There is a way to decrypt while maintaining your data, you can follow this guide. It involved saving a nandroid (saves all info in /data partition except /data/media, where all your media files and certain app data is stored). You can then save anything in /data/media by transferring it to your computer prior to wipe. You can actually restore a nandroid from an encrypted phone onto the same decrypted phone without having all your files encrypted. You can then transfer all your files from the /data/media folder back to your phone, though you'll need to give all the files and folders the proper permissions.
Once decrypted, you phone will remain decrypted until you flash OOS again, such as when updating. To prevent the phone from automatically encrypting its /data partition, you'll have to flash SuperSU or the no-encrypt.zip immediately after flashing an OOS ROM everytime you flash it.
If at some point down the road, you'd like to encrypt your phone again, that's really easy. You can go into the settings app -> secuity -> scroll to bottom to "encrypt". Clicking that option will encrypt your phone without data loss.
I personally have not had any issues after decrypting my phone. I can't speak for others though.
Anova's Origin said:
The TWRP build from the official site is a little outdated, it is known to have decryption issues. Try the one from the XDA page.
To decrypt, you have to either root or flash a dm-verity-no-encrypt.zip that is floating somewhere around on XDA, there's probably a copy of it in the root guide in your first post. If you have no data on your phone that you mind losing (after saving a copy somewhere off your phone), the easiest way to decrypt is to go into TWRP and wipe your /data partition. If your phone is rooted or flashed with the no-encrypt.zip, the /data partition will not be encrypted the next time you boot.
There is a way to decrypt while maintaining your data, you can follow this guide. It involved saving a nandroid (saves all info in /data partition except /data/media, where all your media files and certain app data is stored). You can then save anything in /data/media by transferring it to your computer prior to wipe. You can actually restore a nandroid from an encrypted phone onto the same decrypted phone without having all your files encrypted. You can then transfer all your files from the /data/media folder back to your phone, though you'll need to give all the files and folders the proper permissions.
Once decrypted, you phone will remain decrypted until you flash OOS again, such as when updating. To prevent the phone from automatically encrypting its /data partition, you'll have to flash SuperSU or the no-encrypt.zip immediately after flashing an OOS ROM everytime you flash it.
If at some point down the road, you'd like to encrypt your phone again, that's really easy. You can go into the settings app -> secuity -> scroll to bottom to "encrypt". Clicking that option will encrypt your phone without data loss.
I personally have not had any issues after decrypting my phone. I can't speak for others though.
Click to expand...
Click to collapse
Brilliant. On a side note, I'm sure I did a /data wipe, which caused the boot loop I was having - weird. Anywho, I'll try the TWRP build you mentioned and see how I get on. I did watch one video which suggested to use the fastboot erase userdata as another way of unencrypting the phone.
Either way I'll give it all a try!
Anova's Origin said:
The TWRP build from the official site is a little outdated, it is known to have decryption issues. Try the one from the XDA page.
To decrypt, you have to either root or flash a dm-verity-no-encrypt.zip that is floating somewhere around on XDA, there's probably a copy of it in the root guide in your first post. If you have no data on your phone that you mind losing (after saving a copy somewhere off your phone), the easiest way to decrypt is to go into TWRP and wipe your /data partition. If your phone is rooted or flashed with the no-encrypt.zip, the /data partition will not be encrypted the next time you boot.
There is a way to decrypt while maintaining your data, you can follow this guide. It involved saving a nandroid (saves all info in /data partition except /data/media, where all your media files and certain app data is stored). You can then save anything in /data/media by transferring it to your computer prior to wipe. You can actually restore a nandroid from an encrypted phone onto the same decrypted phone without having all your files encrypted. You can then transfer all your files from the /data/media folder back to your phone, though you'll need to give all the files and folders the proper permissions.
Once decrypted, you phone will remain decrypted until you flash OOS again, such as when updating. To prevent the phone from automatically encrypting its /data partition, you'll have to flash SuperSU or the no-encrypt.zip immediately after flashing an OOS ROM everytime you flash it.
If at some point down the road, you'd like to encrypt your phone again, that's really easy. You can go into the settings app -> secuity -> scroll to bottom to "encrypt". Clicking that option will encrypt your phone without data loss.
I personally have not had any issues after decrypting my phone. I can't speak for others though.
Click to expand...
Click to collapse
Thought I'd post a little update, I managed to install TWRP and Root. I used fastboot erase userdata which fixed my decryption issue - everything was working! Back to stock Nougat now but am going to be trying Magisk.

[Help] Possible to dump the userdata partition?

So I've just gotten the infamous hardware induced boot loop and I've had my return request honoured by Amazon.
While I still have access to the bootloader (nothing else though) and have time to format the userdata partition, I wondered if there's a way to dump the userdata partition so I can retrieve some data from it later (although it's encrypted, I know the password of course).
If this is possible, how can it be done? And how could I decrypt it if there's a method known? If the method of decryption is not known, I guess I could possibly be able to flash it to my new Pixel when I order it, but I'm not entirely sure where/if there's data included within the raw dump that would specify where the partition should be placed (I've not looked into it and only have 2 days before my device MUST be shipped) maybe as an offset from partitions before it, or maybe a specific block range in the flash memory it would be written to.
If this is far from possible, then I don't mind, the only thing I really want to recover is a few meaningless pictures/videos (they're backed up anyway) and the data for my 2FA app so I can drop it in my new device without needing all the hassle of resetting all the codes my every account I have with 2FA enable...

Categories

Resources