Reading encrypted (maybe broken) internal device storage dump - Xiaomi Mi 9 SE Questions & Answers

I've recently did a factory reset, but before doing that I backed up the internal storage partition using
Code:
adb pull /dev/block/sda29
that is my partition for /data according to /cache/recovery/log generated by twrp.
Now I have this little (128GB) file inside my pc, I mounted it into a folder but entering media/0/ it say "Permission Denied" even if I access it using root user. I think is releted with android full encryption.
I tried using testdisk for finding other files and I found a bunch of random named files that testdisk fails to recover, but at least I get into the directory...
Someone can figure out how to access those files? thanks

topongo said:
I've recently did a factory reset, but before doing that I backed up the internal storage partition using
Code:
adb pull /dev/block/sda29
that is my partition for /data according to /cache/recovery/log generated by twrp.
Now I have this little (128GB) file inside my pc, I mounted it into a folder but entering media/0/ it say "Permission Denied" even if I access it using root user. I think is releted with android full encryption.
I tried using testdisk for finding other files and I found a bunch of random named files that testdisk fails to recover, but at least I get into the directory...
Someone can figure out how to access those files? thanks
Click to expand...
Click to collapse
it could be the file extension, windows will not read ext4 files unless you download a tool, linux supports it so you could try mountiong the file on linix or with ext4 app reader (you probably wont be able to modify the data)

Related

Help, was in recovery then I pushed a file to /sdcard, what happens!?!?

So I rebooted to recovery and I push a file into /sdcard
after I shell, I check it's only file in there!! So then I reboot and then adb shell again when phone is regular mode and I don't see that file
Where did I push the file when in recovery? I can't find it next time I reboot to recovery then did LS, the file is gone! Can I delete that file or its lost/hidden or what's going on?
Im not even going to read the whole thing. If u pushed the file and u can't figure out how to reboot from recover just pull battery and restart
Sent from my SCH-I500 using XDA App
You need to mount your sd card to /sdcard.
The file was stored to / on the temporary ramdisk. Do "mount -a" in shell first.
pulser_g2 said:
You need to mount your sd card to /sdcard.
The file was stored to / on the temporary ramdisk. Do "mount -a" in shell first.
Click to expand...
Click to collapse
Thanks for the good info! SO basically the file I pushed over was removed upon rebooting correct? I just don't want that file to be on the ramdisk or sdcard anywhere since the /sdcard was not mounted.

[Q] How do i transfer files to GNex when in recovery mode?

So i've made a mistake. I forgot to download GAPPS but i've already done a factory reset and installed a new rom. I cant seem to mount the usb storage trough clockwork recovery. Is there a way to push the zip file to the device?? Or what should i do?
Thanx
xclusiv8 said:
So i've made a mistake. I forgot to download GAPPS but i've already done a factory reset and installed a new rom. I cant seem to mount the usb storage trough clockwork recovery. Is there a way to push the zip file to the device?? Or what should i do?
Thanx
Click to expand...
Click to collapse
If you only forgot gapps you can restart, the ROM and the phone will work fine you just won't have Google apps. Once it's on you can just copy the file like usual and return to recovery and flash it
Sent from my Galaxy Nexus using xda premium
Good question though. What IF he didnt flash the ROM, how do you get a file on the SDcard if you cant mount it in recovery?
adb push ./"filename.zip" /sdcard
Phone will boot just fine w/o GAPPS.
But you can just use adb push <FILE> <DIRECTORY>
for example:
Code:
adb push gapps.zip /sdcard/
Thanx for the help guys =)
This happens to me all the time. The Mounts section of CWM select "mount as USB" drive. Windows should see this drive and transfer away.
merge5 said:
This happens to me all the time. The Mounts section of CWM select "mount as USB" drive. Windows should see this drive and transfer away.
Click to expand...
Click to collapse
GN internal storage can't be mounted as USB - not even in recovery.
The only way I've found to push/pull files in CWM on the GN is over ADB. If the files in /sdcard/ don't appear, go into mounts and storage, and mount /data. Then try again.
/sdcard/ is nothing more than a symlink to /data/media.
I transfer files over ADB with
'adb push update.zip /data/media/'
no need to mount /data before.
just reboot open up your computer and youll see the gnex just transfer the gapps to your sd card and then reboot in recovery to flash
cmstlist said:
GN internal storage can't be mounted as USB - not even in recovery.
The only way I've found to push/pull files in CWM on the GN is over ADB. If the files in /sdcard/ don't appear, go into mounts and storage, and mount /data. Then try again.
Click to expand...
Click to collapse
Good point. I stand corrected. That was how I did it on my OG Droid. Sorry for the confusion.
bk201doesntexist said:
/sdcard/ is nothing more than a symlink to /data/media.
I transfer files over ADB with
'adb push update.zip /data/media/'
no need to mount /data before.
Click to expand...
Click to collapse
I'm not sure why but CWM on my phone used to auto mount /data and now it doesn't anymore. So to see anything from adb in recovery, I now have to go to mounts first.
Sent from my Galaxy Nexus using Tapatalk
cmstlist said:
I'm not sure why but CWM on my phone used to auto mount /data and now it doesn't anymore. So to see anything from adb in recovery, I now have to go to mounts first.
Sent from my Galaxy Nexus using Tapatalk
Click to expand...
Click to collapse
What cwm version are you on, for instance?
Latest CWM touch as of today, and also tried it with latest CWM non-touch.
Incidentally I just bumped into a caveat of transferring files to the GN in recovery mode. The permissions are set strangely when you push files over ADB in recovery, and as a result when booted into the OS I was unable to rename any of the pushed files/folders or put new files in. Since the DCIM directory was one that I'd pushed over, new photos weren't saving. And I did not have permission to change permissions.
This is pretty much a brute force method - so I rebooted into recovery again, mounted /data, did adb shell, cd sdcard, and then:
chmod -R 777 *
And upon booting back into the OS, everything works properly again.
I know that messing with permissions is usually a dangerous thing. My logic was that anything stored in /sdcard is supposed to be a file that any app would be allowed to access as long as it has SD permissions - it's been that way in every version of the OS through to 4.0.
But anyway, if there's something I should do to decrease the "unsafeness" of this situation, please advise me. I guess in theory this would give a malicious app permission to execute code from /sdcard, which would make me more vulnerable?
EDIT: Okay more to report. To see the permissions properly when booted into the OS, you have to go into /data/media rather than /sdcard (same directory but permissions appear differently).
When I went in there and typed ls -n, I found that all the files I had pushed in recovery have UID & GID of 0. All files I had created afterwards had UID & GID of 1023. That explains everything. The owner is root for files that came from ADB in recovery, and media_rw for files created in the OS.
I can use chown, but it looks like the version of chown that comes with busybox does not have -R recursion implemented. Hrm. Aha! In CWM, chown does support -R. And we're off to the races. So from recovery I did:
cd /data/media
chown -R media_rw.media_rw *
cmstlist said:
Latest CWM touch as of today, and also tried it with latest CWM non-touch.
Incidentally I just bumped into a caveat of transferring files to the GN in recovery mode. The permissions are set strangely when you push files over ADB in recovery, and as a result when booted into the OS I was unable to rename any of the pushed files/folders or put new files in. Since the DCIM directory was one that I'd pushed over, new photos weren't saving. And I did not have permission to change permissions.
This is pretty much a brute force method - so I rebooted into recovery again, mounted /data, did adb shell, cd sdcard, and then:
chmod -R 777 *
And upon booting back into the OS, everything works properly again.
I know that messing with permissions is usually a dangerous thing. My logic was that anything stored in /sdcard is supposed to be a file that any app would be allowed to access as long as it has SD permissions - it's been that way in every version of the OS through to 4.0.
But anyway, if there's something I should do to decrease the "unsafeness" of this situation, please advise me. I guess in theory this would give a malicious app permission to execute code from /sdcard, which would make me more vulnerable?
EDIT: Okay more to report. To see the permissions properly when booted into the OS, you have to go into /data/media rather than /sdcard (same directory but permissions appear differently).
When I went in there and typed ls -n, I found that all the files I had pushed in recovery have UID & GID of 0. All files I had created afterwards had UID & GID of 1023. That explains everything. The owner is root for files that came from ADB in recovery, and media_rw for files created in the OS.
I can use chown, but it looks like the version of chown that comes with busybox does not have -R recursion implemented. Hrm. Aha! In CWM, chown does support -R. And we're off to the races. So from recovery I did:
cd /data/media
chown -R media_rw.media_rw *
Click to expand...
Click to collapse
that would explain it: i always use /data/media, didn't find any permission issues yet. thanks.

[Solved] unable to copy apk to /system/apk/

I am trying to copy apk from data/app to system/app.
However it always failed with error insufficient storage / memory.
I have tried it using Root explorer by ensuring the r/w mount but still failed.
I believe i still have around 100MB left in the /system while the apk i tried to copy is only 70KB
I also have tried using terminal but still same error: "Out of Memory"
I am using Gingervillain 3.3 and used to root via unrevoked 3.21
Any help is appreciated.
Thanks
co-lee said:
I am trying to copy apk from data/app to system/app.
However it always failed with error insufficient storage / memory.
I have tried it using Root explorer by ensuring the r/w mount but still failed.
I believe i still have around 100MB left in the /system while the apk i tried to copy is only 70KB
I also have tried using terminal but still same error: "Out of Memory"
I am using Gingervillain 3.3 and used to root via unrevoked 3.21
Any help is appreciated.
Thanks
Click to expand...
Click to collapse
I assume you are s-on.
If you are s-on, then you can't modify the system partition while the operating system is booted. Try booting in recovery, and using adb to copy the apk from /data/app to /system/app.
Furthermore, S-OFF also reduces restrictions on accessing the NAND flash memory on the device, allowing all partitions (including /system) to be mounted in write mode while the operating system is booted.
Click to expand...
Click to collapse
Wohoo! it works!
Thanks a lot m8

Question regarding internal storage... a big mystery!

I recently had a problem where I had to do a factory restore on a non-bootable phone... and my only option was to use adb shell to copy the extracted stock lollipop nandroid files to the TWRP folder in internal storage [there may have been other ways, but I was not aware of one.]. Thanks to 3484jacks, thebobmannh, ckpv5, and redpoint73. I hope I didn't forget anyone.
OK.. so that worked... but it was very messy. Why? Because my first (and obvious) choice was to create the subfolder under TWRP and then adb push the files to that folder.
The folder I am referring to is the "root" folder of internal storage, also called the /sdcard/. It usually has other directories/folders such as .data, Android, Ringtones and/or Media.... I am sure you know what I am referring to. And on this "root" of the internal storage (sdcard) is the TWRP folder which contains backups. The path to the backups is sdcard/TWRP/BACKUPS/{device serial number}/name-date of backup.
However, when I did an adb push to the above folder, by using the following command:
adb push c:/nandroid/ /sdcard/ TWRP/BACKUPS/FXXXXX/nandroid (<<==I had already created the nandroid folder as you cannot push an entire folder to your phone; only the files contained therein will be pushed over)
....my files did not end up in /sdcard/TWRP/BACKUPS/FXXXXX/nandroid. Instead they were copied to /sdcard/storage/TWRP/BACKUPS/FXXXXX/nandroid. For some reason when pushing to the sdcard, adb pushes it to a subfolder called storage. I am not sure why this is... perhaps it is because we really are not talking about a physical sdcard, but rather internal storage. In any event, to fix my phone I had to use adb shell and I copied all of the nandroid files from /sdcard/storage/TWRP/{. . .} to /sdcard/TWRP/{ . . .}.
If you are in the true root (system) directory, there are several paths which lead to "internal storage"... and I want to know if anyone has any clue why there are multiple paths and what they mean. Below are the multiple paths from the system directory to internal storage:
(root)/storage/emulated/0/
(root)/storage/emulated/legacy/
(root)/storage/sdcard/
(root)/sdcard/
All of above paths lead to the exact same place (or so it seems)...a place which very much appears like internal storage.
However, I have run into this weird creation of a storage folder on the sdcard (internal storage) before. Several months ago, I copied via USB my entire sdcard to my Windows desktop. Oddly, several folders that I would have expected to be on the sdcard (as they are when viewing with Root Explorer) were not there. When inspecting what I had copied to my desktop, I found that the Download folder and 4 or 5 other folders, ended up in a "/(sdcard)/storage" sub-folder. EXACTLY like what happened to me yesterday (but kind of in reverse as I was copying TO the sdcard)
So that is my first question... Why does this happen? What is emulated? what is the difference between (root)/storage/emulated/0/ and (root)/storage/emulated/legacy/????
My next question, very intimately related to the above, is more of a problem.
The nandroid files I referred to above which I had initially pushed to the sdcard whereupon they ended up in the storage subfolder are still there. And whether I use Root explorer or adb shell, I get a "DELETE FAILED" or "PERMISSION DENIED" error respectively. And in case you are wondering, I did a 'su -' in adb shell before I attempted this. I had to grant access to SuperSU as a toast came up asking for the root rights.
Strange....I never thought internal storage had permissions, but I guess they do.
So the big question...and a solution to getting rid of the mess of files which are taking up several GBs of space on my sdcard (internal storage)... how do I delete the /storage/ folder on my sdcard? The folder was not there before.
Even if I drill down to the individual files (either in adb shell or root explorer) I still get a PERMISSION DENIED.
Please help. NOTE: I thought about reformatting the partition... but what guarantee will I have if I try to push my backed up sdcard data BACK to internal storage?? I probably can make sure that I delete the problematic nandroid files above by deleting them first in Windows, but that doesn't mean my sdcard won't still have another storage subfolder create.... and who knows what will be in it? [and this is the genesis behind my asking the first questions above about internal storage, the "emulated" name in the path, and the multiple paths from the system folder. I figured if I understood what was going on, I would be more likely to fix it.]
Thank you in advance for any assistance!!!

Question Internal storage '/sdcard' unmounted [SOLVED!]

I am running the latest stock Oxygen OS version (11.2.10.10.LE15AA), rooted with Magisk. Somehow the internal /sdcard directory got unmounted and now I cannot save anything to the user storage because it doesn't exist. I could not even take screenshots because it saves by default to /sdcard/DCIM/Screenshots which doesn't exist now, so I apologize for having to take photos of a screen (the first is from terminal, the other 2 are from ES File Explorer). However, when I run "ls -la /" as superuser in a terminal window it lists sdcard. Does anyone know how to fix this? How do I re-mount /sdcard and get it recognized again?
eudemonics said:
I am running the latest stock Oxygen OS version (11.2.10.10.LE15AA), rooted with Magisk. Somehow the internal /sdcard directory got unmounted and now I cannot save anything to the user storage because it doesn't exist. I could not even take screenshots because it saves by default to /sdcard/DCIM/Screenshots which doesn't exist now, so I apologize for having to take photos of a screen (the first is from terminal, the other 2 are from ES File Explorer). However, when I run "ls -la /" as superuser in a terminal window it lists sdcard. Does anyone know how to fix this? How do I re-mount /sdcard and get it recognized again?
Click to expand...
Click to collapse
Try to reboot to recovery and factory reset
Fixed the /sdcard unmounted error!
What finally ended up working was flashing the Oxygen OS zip in TWRP and rebooting without root. I noticed my internal storage was restored along with all the files in it — but then when I rebooted to bootloader to re-root the device with a Magisk-patched boot.img (booting into Android once as temp root with "fastboot boot magisk_patched.img", then running the Magisk app and selecting "direct install" to patch boot.img for permanent root) the /sdcard unmounted error came back! So I disabled all the newer Magisk mods I had installed, rebooted, and I have /sdcard again along with root. Yay! Factory reset was going to be my next attempt if that didn't work though.

Categories

Resources