My wife has a PIN on her phone. She told our 6 yr old to put the phone down as she put my our other children to bed, and when she came back the phone was erased and reset. He couldn't have got in to the phone and through the menus. Does the phone reset and wipe everything after too many failed attempts at the PIN? Is there anyway out of this? I am familiar with rooting phones. Is there any back entry and restore through ADB? The phone was not previously rooted.
Doesn't take long to navigate to settings and do a factory reset.
Data is likely lost but you can try... I hope you backed up critical data. Even if you do manage to retrieve it the file structure has been lost.
A sea of random files and no way to recreate the file structure or associations except by memory.
blackhawk said:
Doesn't take long to navigate to settings and do a factory reset.
Data is likely lost but you can try... I hope you backed up critical data. Even if you do manage to retrieve it the file structure has been lost.
A sea of random files and no way to recreate the file structure or associations except by memory.
Click to expand...
Click to collapse
So pictures and everything are gone?
He doesn't know the PIN. Is there something that comes up that's says the phone will be wiped after so many bad attempts that he could have pressed?
Schroeder09 said:
So pictures and everything are gone?
He doesn't know the PIN. Is there something that comes up that's says the phone will be wiped after so many bad attempts that he could have pressed?
Click to expand...
Click to collapse
Jpeg files if recoverable will be separated from their exif files, no order, original time stamp or number. Even 100 jpegs are a small nightmare to try and sort.
You start to get the depth of the problem.
Not sure but I think you're correct.
I never use screen locks or encryption; security is purely physical. Meh, wysiwyg
"Kids do the darndest things..."
My cousin once "waxed" the whole kitchen floor with a bottle of baby oil.
My mother exclaimed:"Who did this?!"
Danny replied:"I doed it!"
He was quite proud of his achievement. The floor really did shine... clean up took a bit longer then the wax job.
Somebody may have a better plan than my call it a wash. If backed up on cloud you have another option. Personally I use hard backups.
blackhawk said:
Jpeg files if recoverable will be separated from their exif files, no order, original time stamp or number. Even 100 jpegs are a small nightmare to try and sort.
You start to get the depth of the problem.
Not sure but I think you're correct.
I never use screen locks or encryption; security is purely physical. Meh, wysiwyg
"Kids do the darndest things..."
My cousin once "waxed" the whole kitchen floor with a bottle of baby oil.
My mother exclaimed:"Who did this?!"
Danny replied:"I doed it!"
He was quite proud of his achievement. The floor really did shine... clean up took a bit longer then the wax job.
Somebody may have a better plan than my call it a wash. If backed up on cloud you have another option. Personally I use hard backups.
Click to expand...
Click to collapse
How do I try to see what is left on the phone? Is there an ADB process for this?
I've never understood backing stuff up on a phone. The restoring part seems to be more the problem for me. I did used to do multiple backups with titanium backup, but never once was successful restoring from the backup. How are you backing up and how are you restoring from it? Especially on a NON-ROOTED device? The latter will be more important. When I pick up my next phone (probably an s22. Currently have rooted 2xl running A10 yet) I will not be rooting. It's too much of a time-consuming PITA, and while the gains are noticeable; they're not worth the effort.
Not sure what if anything adb can do for you. I never use that to restore as I run stock devices and assume the file decryption keys are already lost as well as file structure after a factory reset!
For backup first identify all critical data that can be backed up. DCIM folder, Documents, contacts, all needed accounts/passwords written or as text files etc, music, vids and so on.
Apps that allow backup of settings like Poweramp and Color Note (can be used for bookmarks rather than the browser). I use ApkExport to make installable copies of all my apps and updates. On reload no Playstore needed.
Copy, paste, verify size and if readable to 2 or more hdds that are physically and electronically isolated from each other and the PC. A OTG flashstick can be used for quick backups but don't use as the only backup; hdds are more reliable. Work out a sync folder for media, etc.
SmartSwitch can be used to backuo homepage but never rely on it to backup critical data! It may or may not work!!!
If you have an SD card slot use an SD card as a data drive; all critical data goes here. There can be only DCIM folder so periodically backup the DCIM folder to the SD card but name something without DCIM in the name. Only apps and the download folder go on internal memory. Then backup the SD card redundantly and regularly to the hdd backups. That gives you multiple backups should one fail. NEVER encrypt backup data drives!!!
You have to methodically plan this to do backup this way but it's pretty foolproof and has built in redundantcy. Once you get used to it, it's not hard to do.
I have over a dozen backup hdds in various locations. I may lose some data but never all my data. Syncing data is the biggest headache with this method.
blackhawk said:
Jpeg files if recoverable will be separated from their exif files, no order, original time stamp or number. Even 100 jpegs are a small nightmare to try and sort.
You start to get the depth of the problem.
Not sure but I think you're correct.
I never use screen locks or encryption; security is purely physical. Meh, wysiwyg
"Kids do the darndest things..."
My cousin once "waxed" the whole kitchen floor with a bottle of baby oil.
My mother exclaimed:"Who did this?!"
Danny replied:"I doed it!"
He was quite proud of his achievement. The floor really did shine... clean up took a bit longer then the wax job.
Somebody may have a better plan than my call it a wash. If backed up on cloud you have another option. Personally I use hard backups.
Click to expand...
Click to collapse
how could I attempt to recover these JPEG files?
Schroeder09 said:
how could I attempt to recover these JPEG files?
Click to expand...
Click to collapse
What OS version? Not rooted?
I don't think you got a prayer but it depends on if the old data is encrypted which I assume it is because of the screen lock.
Full-Disk Encryption | Android Open Source Project
source.android.com
Of you're really hell bent on recovering some of the data a data recovery service that specializes in Samsung's is probably your best shot.
I could be wrong... do some Google searches, to search XDA simply add "XDA" to the end of the Google search parameter. XDA's search engine leaves something to be desired... and misses a lot that the all seeing Google web crawlers don't.
Leave the phone powered down until you decide what to do as any activity can now overwrite those old files.
Is this droidkit a gimic or will it work? the note 8 is on android 8 or 9.
Get Data Recovery, Screen Unlock, and FRP Bypass with DroidKit
www.xda-developers.com
Schroeder09 said:
Is this droidkit a gimic or will it work? the note 8 is on android 8 or 9.
Get Data Recovery, Screen Unlock, and FRP Bypass with DroidKit
www.xda-developers.com
Click to expand...
Click to collapse
Most likely a gimmick if not malware. AFAIK a factory wipe doesn't actually erase or overwrite the storage, it just removes the file structure and pointers, so a forensic data recovery tool could potentially help. Unfortunately, doing this on a smartphone is even harder to do, especially considering that most newer Samsung devices use encryption, and since a new key is generated when the device is reset, it won't be able to read the old data.
V0latyle said:
Most likely a gimmick if not malware. AFAIK a factory wipe doesn't actually erase or overwrite the storage, it just removes the file structure and pointers, so a forensic data recovery tool could potentially help. Unfortunately, doing this on a smartphone is even harder to do, especially considering that most newer Samsung devices use encryption, and since a new key is generated when the device is reset, it won't be able to read the old data.
Click to expand...
Click to collapse
Brute forced decryption be the only way as it uses random encryption. Folders are encrypted vs full disk encryption on the newer OS's if I recall correctly. The folder association with the files is already gone, lost with the factory reset. How the effects the encryption, no clue.
It's a mess.
blackhawk said:
Brute forced decryption be the only way as it uses random encryption. Folders are encrypted vs full disk encryption on the newer OS's if I recall correctly. The folder association with the files is already gone, lost with the factory reset. How the effects the encryption, no clue.
It's a mess.
Click to expand...
Click to collapse
is there a service that can recover the pictures? my wife already restarted the phone and has started downloading stuff (if that matters). I told her it would have been best to not even have restarted it and hand it to someone so they could recover from recovery mode prior to any new data being installed.
V0latyle said:
Most likely a gimmick if not malware. AFAIK a factory wipe doesn't actually erase or overwrite the storage, it just removes the file structure and pointers, so a forensic data recovery tool could potentially help. Unfortunately, doing this on a smartphone is even harder to do, especially considering that most newer Samsung devices use encryption, and since a new key is generated when the device is reset, it won't be able to read the old data.
Click to expand...
Click to collapse
Is there any company or service who aren't criminals that I can send it to to recover the pictures?
I think it's a dead horse especially if you're wife keeps using it!
Found this one. Do some searches and research.
Keep the phone powered off until you decide.
Related
I'm assuming this is associated with the recent phenomenon of hardware ID's changing everytime a new ROM is installed. Apparently MS uses the same hardware ID when it encrypts files on SD cards. What this means is you will lose all of your files on the SD card (including backup files) if you have encryption turned on, the files get encrypted, and then you switch ROM's.
So.. uh.. this is just a little warning, and it might be obvious to everyone but me... don't use SD encryption unless you know you're going to stick with a ROM.
I have no idea why MS doesn't just use the IMEI, but... they don't.
From what I read about the encryption, the key is generated after a hard reset, so basically you can't hard reset the device once data is encrypted.
Do you know wether there is an option to backup ones key to a file, save it to ones PC, and then reimport it once one has finished hardresetting the device?
If I were MS I'd see the vast usefullness of such an option and integrate it at once
the encryption key is created when you turn the Setting on...
and when flashing a new ROM or a HardReset the key is desteroid...
i am still yet to find the location... still looking...
Providing you remember, can't you just turn off the setting before a flash or hard reset and restore all the files to there unencrypted state?
Once the ROM has been flash and everything hard-reset you can just encrypt them again?
Percz said:
Providing you remember, can't you just turn off the setting before a flash or hard reset and restore all the files to there unencrypted state?
Once the ROM has been flash and everything hard-reset you can just encrypt them again?
Click to expand...
Click to collapse
No, because turning it off doesn't decrypt existing encrypted files. Just like turning it on doesn't encrypt the normal files. It will decrypt them as you open and resave them.
:-\
walshieau said:
the encryption key is created when you turn the Setting on...
and when flashing a new ROM or a HardReset the key is desteroid...
i am still yet to find the location... still looking...
Click to expand...
Click to collapse
OK; that makes sense. I just realized that after I hard-reset I restored most of my settings with the data from a backup (Sprite Backup). I wasn't seeing the encoded files problem because I was restoring from a non-encrypted file.
ugh.
y2whisper said:
From what I read about the encryption, the key is generated after a hard reset, so basically you can't hard reset the device once data is encrypted.
Click to expand...
Click to collapse
That makes perfect sense, actually. That way someone can't hard reset your phone to get at the data.
Too bad it also means the real owner can't get to his own data..
Some FAQs from the horse's mouth: http://blogs.msdn.com/windowsmobile...ows-mobile-6-storage-card-encryption-faq.aspx
What you can do is ActiveSync your Device and then drag and drop all the files you want to keep before the hardreset. And then when you finish installing your ROM and Hardresetting your device, just transfer back the files via activesync. I know its tedious and long if you have like 1 gig of **** in the SD card, but thats the only way i've found.
just lost files to encryption
Been reflashing my 8525 with new versions of custels and vanilla and have never lost files to encyption. However just flashed to Black 3.01 and lost all my stuff. If i flash back to my previous ROM is it conceivable that the same key will be created and i will regain access to my files?
Unfortunately, I was also unaware of this. I presumed MS would use a key based on the hardware or something like that.
Anyway, is there any way of breaking the encryption and get back the files?
Thanks!
Keshen
As the DataProtection API as in WinXP and Win2003 is used, it is AES-128 by default.
"The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths."
So brute force attack is not really an option….
As the key is stored somewhere in the flash I think this will be the only feasible way to decrypt the files.
But as the key is lost because of the hard-reset during upgrade, there is not much hope...
Only if we can get more information on how the keys are generated, maybe this will reduce
the complexity of an attack.
You won't have good luck trying to crack the encryption. Which, is actually a good thing since the purpose is to keep your data safe in the wrong hands. I prefer to use a 3rd party encryption solution as it allows more choices and control.
MrGAN said:
As the DataProtection API as in WinXP and Win2003 is used, it is AES-128 by default.
"The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths."
So brute force attack is not really an option….
As the key is stored somewhere in the flash I think this will be the only feasible way to decrypt the files.
But as the key is lost because of the hard-reset during upgrade, there is not much hope...
Only if we can get more information on how the keys are generated, maybe this will reduce
the complexity of an attack.
Click to expand...
Click to collapse
Breaking AES is pretty hopeless unless you have access to the NSA's computer systems.
The big problem, in my opinion, is MS doesn't give you an easy way to back up the key and restore it. Now that I've given it more thought, it makes perfect sense that the key gets nuked on a hard-reset: otherwise someone could just hard-reset your phone and have access to your data. In most cases, it's better to permanently lose the data than to allow someone else to have access to it.
Another thing that MS would be wise to offer is a "mass decrypt" function that would go through the entire SD and decrypt all of the encrypted files.
Other than that -- the way I've been dealing with it is by using SpriteBackup (I'm sure SBP does this too) and back up the SD card along with the main memory. Since the encoding happens in the OS level, the backup software sees the normal unencrypted files. So this way I can restore the SD backup after a rebuild (I don't recommend restoring the main ROM image, since so much changes between each release).
j
keshen said:
Unfortunately, I was also unaware of this. I presumed MS would use a key based on the hardware or something like that.
Anyway, is there any way of breaking the encryption and get back the files?
Click to expand...
Click to collapse
Once you hard-reset your device and lose that key, your files are gone, unless you somehow have access to some very very high powered computer systems that can break AES -- and even then it would take several years.
I think the NSA in the US has managed to break AES (that's the rumor I've heard), but it takes quite some time.
j
AES-128 offers a sufficiently large number of possible keys, making an exhaustive search impractical for many decades.Correctly implemented AES-128 is likely to protect against a million dollar budget for at least 50 – 60 years and against individual budgets for at least another 10 years.
But as there are many pitfalls to avoid when encryption is implemented, and keys are generated.
So if the key is easy to guess it doesn’t matter if AES is secure ot not.
Creating good and strong keys is a surprisingly difficult problem and requires careful design when done with a computer. The challenge is that computers are notoriously deterministic, but what is required of a good and strong key is the opposite – unpredictability and randomness.
Provided that the implementation is correct, the security provided reduces to a relatively simple question about how many bits the chosen key, password or pass phrase really corresponds to. Unfortunately this estimate is somewhat difficult to calculate, when the key is not generated by a true random generator.
To make a long story short: if at all then the key generation might be the weak spot...
So i've to realyze that i've lost all the data of mi SD card. That sounds incredible!!, i don't know if i will be able to recover all the changes made.
I installed Mobsync, wich makes me backups of the SD data to avoid SD corruption, but the files are also encrypted on my PC.
WM5torage
I'm curious if anybody has tried turning encryption on, and using WM5torage to transfer files to/from the Hermes. Does it properly encrypt/decrypt the files, or does that work only when using ActiveSync?
-- Joe
Sadly, last week my Droid Incredible got stuck in a reboot loop that I was unable to get it out of. At the time, I thought it was no big deal since most of my data (emails, contacts, voice messages) were stored safely in the cloud. I figured that if I tried a Factory Reset, it would only be a small pain to re-download the apps, and I might lose some data such as game scores. My phone had not been rooted (didn't think I needed to), and I went ahead with the Reset. Afterward I rooted the phone, made a backup of the freshly re-installed OS, and installed Cyanogenmod,
Skip forward to today. I took a few photos and while I was viewing them in the gallery, I noticed that none of my pre-Reset photos were there. Now I am at home and notice that my earlier photos are nowhere to be found. I always assumed they were being stored safely in the SD card and not in the Internal storage. However, I have just finished searching the SD card, the current Internal storage, and the post-Reset backup files. I am sadly realizing that the photos must have been previously stored on the phone's Internal memory (STUPID, HTC!!!) and are now lost forever. Is there any chance they may still be hiding out in an area I haven't though of, or is there any way to run diagnostic-type tools on the internal memory to try and recover the bits of lost photos? Most of them weren't all that important, but I would be so sad to lose many of them. Any help would be appreciated.
If they were on the SD Card and somehow got deleted you can try RecoverMyFiles to see if it will recover them.
Code:
http://www.recovermyfiles.com/
Have used it many times in the past with great results.
Yep. I've used similar software to recover files from an SD card. But I'm fairly certain now that the files were being stored internally. I know this may be a lost cause, but I'm really hoping someone has figured out a solution.
salviati said:
Yep. I've used similar software to recover files from an SD card. But I'm fairly certain now that the files were being stored internally. I know this may be a lost cause, but I'm really hoping someone has figured out a solution.
Click to expand...
Click to collapse
Unless you changed the setting to store internally then no. By default it saves them to the SD. It is a known issue in just about every rom including stock that this happens one in a million times. Odds are you won't be able to recover. All I can say is to back them up on a PC regularly from now on. Doubt you will ever see that problem again, but you can never be too safe. I lost some great photos I took on my original Droid.
I have a real cry for help!
Somehow all my pictures disappeared from my Galaxy Nexus. My only possible explanation (since it could not have decided to delete them itself!) is that I must have been a complete idiot and last night when I thought I was deleting a video I had just taken I must deleted the camera directory itself. This is supported by the fact that there was no ‘camera’ directory when I looked this morning. I then took a new photo and the directory reappeared. I have plenty of experience with PC’s but I’m a newbie with smartphones. I figured if I don’t write any more files to the phone then most of the actual data should still be there so I hoped to do some kind of undelete.
I’ve done some research and it looks like the ‘feature’ of only connecting as an MTP device (rather than USB mass storage) is potentially a killer blow. Without an assigned drive letter it seems that none of the usual recovery programmes will recognise the phone.
In theory an alternative might be to take a complete image of the phone contents and somehow recover the data from here?
I am pretty desperate as I have five months of pictures/videos of my kids etc, and most of that data must still be on the phone – but how to get to it?
Finally – yes I am a complete plonker, I shouldn’t have made such a stupid mistake and I should have backed up the phone or the pictures. I have learned my lesson. But given that, is there anything I can do?
BTW - the phone came from 3 network (via a reseller) and I have not touched it with respect to unlocking/rooting etc. It is in the state I received it.
HELP please!
Thanks very much...........
I believe the MTP vs. USB Mass storage would be a driver thing. There are many different versions of drivers so its possible there are ones that will mount the phone with a drive letter. I can think of some other things to try (Boot into fastboot mode by turning phone off then powering on by holding power, volume up and volume down at the same time and holding till it vibrates). You could also try Disk Management under windows to see if you can assign a letter
In the future I highly recommend setting up a google account and using Google Photo/Instant Upload to keep a backup of your photos. You dont even have to sync anything else
Thanks for your suggestions, much appreciated.
I’ve now tried going into fastboot mode and connecting to PC but no joy – Windows recognises there is a device connected (usually ID’d as an OMAP4440) but can’t find a driver.
Disk Management also doesn’t show the Nexus as a drive and therefore won’t allow a Drive letter to be assigned.
Try these (obviously no guarantees and I havent used any personally)
https://play.google.com/store/apps/details?id=fahrbot.apps.undelete
http://android-photo-recovery.com/tutorials/deleted-file-recovery-for-google-nexus-phones.html
EDIT: Found another:
http://www.wondershare.com/disk-utility/recover-deleted-photos-from-nexus-s-and-galaxy-nexus.html
Thanks again, I appreciate all suggestions. Yes I have come across these and unfortunately they don’t solve my issue. The last two are amongst those I’d seen reported as not working as they need a drive letter. I had installed both anyway but found that to be true (
The first requires root access which I don’t have. If I understand correctly, to root I’ll need to unlock the bootloader first, and unlocking will erase all the data anyway??
Unfortunately, you are out of luck. You cannot mount the storage on a GNex in USB Mass Storage mode, and I am pretty sure that none of the "undelete" programs that run in Android support ext4 (which is what our GNex internal storage is formatted).
If you are running 4.0.1 or 4.0.2, you can still get root access without losing your data (but not on 4.0.4), but I can't see how it will help you given what I mentioned above.
I am on 4.04 so sounds like I can't get root access without overwriting, can I roll back to 4.01/2 without overwriting the data? (sounds unlikely but I have to ask - I upgraded from 4.02 without losing data....).
If not, is there a way to get a data image without rooting? That way at least I have the data preserved if at some future point it becomes possible to do an undelete on Ext4 data??
Gavdroid said:
[snip]
can I roll back to 4.02/3 without overwriting the data?
Click to expand...
Click to collapse
Unfortunately no.
Gavdroid said:
If not, is there a way to get a data image without rooting? That way at least I have the data preserved if at some future point it becomes possible to do an undelete on Ext4 data??
Click to expand...
Click to collapse
I believe there are utilities to "do an undelete" on ext4. The problem is how to get access to the data image. I don't really know of any way to pull off the data partition of a GNex to your computer, but it may be possible.
Have a look at this thread. I think shaaXo managed to find a way for your computer to see the memory on the GNex and likely dump it (although it is not very user-friendly).
That sucks. If it's deleted, it's gone for good. Sorry, buddy.
Sent from my Galaxy Nexus using XDA
Thanks very much I will go through that post and see where I get to!
Edit! - uh-oh, taking a quick look it seems you need to use CWM, which I take to be ClockworkMod, which I thought required the phone to be rooted to install it? And if I understand correctly, rooting requires an unlocked bootloader, which wipes your data??
I will take a deeper look in case I've misunderstood (very likely), but am I thinking clearly here?
Hi Guys,
yesterday my wife was deleting a couple of pictures from the gallery, and suddently the phone started deleting all of them.
I trust her in saying she didn't select them all since she also told me that the screen was displaying "deleting 3 elements".
She was fast enough to power down the phone but nevertheless all pictures are gone.
I tried with some tool found on the web but said tools were not able to recover any deleted pictures.
It's a non rooted phone, everything stock, 6 months device.
It's just for the value of the pictures of our kid inside of the phone that I'm writing here and yes I know backup should have been made, but alas they were not made...
We recovered something through friends and whatsapp but most are gone.
If anyone has some idea please I'm all ears
Best regards and thanks to you all, it's a great community
kidamnesiac said:
Hi Guys,
yesterday my wife was deleting a couple of pictures from the gallery, and suddently the phone started deleting all of them.
I trust her in saying she didn't select them all since she also told me that the screen was displaying "deleting 3 elements".
She was fast enough to power down the phone but nevertheless all pictures are gone.
I tried with some tool found on the web but said tools were not able to recover any deleted pictures.
It's a non rooted phone, everything stock, 6 months device.
It's just for the value of the pictures of our kid inside of the phone that I'm writing here and yes I know backup should have been made, but alas they were not made...
We recovered something through friends and whatsapp but most are gone.
If anyone has some idea please I'm all ears
Best regards and thanks to you all, it's a great community
Click to expand...
Click to collapse
She mistakenly selected all to delete..
But she has bin so she did delete twice???
Does she have Google photos active?
PhoneTechShop said:
She mistakenly selected all to delete..
But she has bin so she did delete twice???
Does she have Google photos active?
Click to expand...
Click to collapse
No she didn't select them all. She only selected 3 of them. A system failure, or bug, caused the phone os to start delete everything from the gallery. Photos were never transferred to the bin, which happens when you willingly delete them. Sadly we did not have Google Photos active, so we're not able to recover them from the cloud.
Do you think there's a chance of getting them back somehow. I've tried with commonly know recovery software but they require root for deep scan, and the booloader is unlockable... :crying:
kidamnesiac said:
No she didn't select them all. She only selected 3 of them. A system failure, or bug, caused the phone os to start delete everything from the gallery. Photos were never transferred to the bin, which happens when you willingly delete them. Sadly we did not have Google Photos active, so we're not able to recover them from the cloud.
Do you think there's a chance of getting them back somehow. I've tried with commonly know recovery software but they require root for deep scan, and the booloader is unlockable... :crying:
Click to expand...
Click to collapse
No photos gone... Really weird how she done it.. This never happens... She musted done something else..
Sorry to here that.
To the best of my knowledge. If you really want to recover the images, you need to keep the phone turn off until you can find the way to recover it. If you keep using it all your data will be overwritten.
I have not been hacking Android device for a while. For Qualcomm devices, you may force the device to enter the flashing mode which can be used to dump ram data from flash memory of the phone (e.g., using dd command). Also, you need to know number of memory block in order to do that.
After getting all raw memory (flash) image from you phone. You can you generic linux photo recovery tool to recover you files.
You might read more from this post.
https://forum.xda-developers.com/android/development/guide-fixing-hard-bricks-t3403868
https://www.forensics-matters.com/2018/07/08/dump-android-partition-for-forensics/
However, you need to do quite a lot of research. For example, how to force Huawei device into a download mode (like Qualcomm), how to dump raw memory from the mainboard, etc.
kidamnesiac said:
Hi Guys,
yesterday my wife was deleting a couple of pictures from the gallery, and suddently the phone started deleting all of them.
I trust her in saying she didn't select them all since she also told me that the screen was displaying "deleting 3 elements".
She was fast enough to power down the phone but nevertheless all pictures are gone.
I tried with some tool found on the web but said tools were not able to recover any deleted pictures.
It's a non rooted phone, everything stock, 6 months device.
It's just for the value of the pictures of our kid inside of the phone that I'm writing here and yes I know backup should have been made, but alas they were not made...
We recovered something through friends and whatsapp but most are gone.
If anyone has some idea please I'm all ears
Best regards and thanks to you all, it's a great community
Click to expand...
Click to collapse
jskasia said:
Sorry to here that.
To the best of my knowledge. If you really want to recover the images, you need to keep the phone turn off until you can find the way to recover it. If you keep using it all your data will be overwritten.
I have not been hacking Android device for a while. For Qualcomm devices, you may force the device to enter the flashing mode which can be used to dump ram data from flash memory of the phone (e.g., using dd command). Also, you need to know number of memory block in order to do that.
After getting all raw memory (flash) image from you phone. You can you generic linux photo recovery tool to recover you files.
You might read more from this post.
https://forum.xda-developers.com/android/development/guide-fixing-hard-bricks-t3403868
https://www.forensics-matters.com/2018/07/08/dump-android-partition-for-forensics/
However, you need to do quite a lot of research. For example, how to force Huawei device into a download mode (like Qualcomm), how to dump raw memory from the mainboard, etc.
Click to expand...
Click to collapse
Thanks for the heads up, will surely do the reading required, though from the look I gave, it seems root is always required to access those kind of data. And rooting this Huawei proves to be quite impossible without the unlocked bootloader. Well one may say there're just pics and videos, but the first words of my son.... ?
kidamnesiac said:
Thanks for the heads up, will surely do the reading required, though from the look I gave, it seems root is always required to access those kind of data. And rooting this Huawei proves to be quite impossible without the unlocked bootloader. Well one may say there're just pics and videos, but the first words of my son.... ?
Click to expand...
Click to collapse
you won't be able to recover them as windows doesn't see the drive as normal mass storage from the phones .. so once u open some recovery software it won't see that drive.. I already tried...
Firstly, it seems hopeless, honestly.
Secondly, we might discuss for the sake of knowledge only. I didn't mean to mount phone storage from windows.
What I meant so far was to access all phone data using "flashing mode" which is used to repaire bricked device. The dumped data should be in form of raw memory data (I used to mount the raw memory image of the phone to find the key to unlock bootloader). By using the similar approach as data recovery (linux based), we might be able to recover files data from the phone.
If you seriously need data you might talk to this group of people (https://hcu-client.com/) and see if they could dump all data from the phone using their repair kit.
PhoneTechShop said:
you won't be able to recover them as windows doesn't see the drive as normal mass storage from the phones .. so once u open some recovery software it won't see that drive.. I already tried...
Click to expand...
Click to collapse
jskasia said:
Firstly, it seems hopeless, honestly.
Secondly, we might discuss for the sake of knowledge only. I didn't mean to mount phone storage from windows.
What I meant so far was to access all phone data using "flashing mode" which is used to repaire bricked device. The dumped data should be in form of raw memory data (I used to mount the raw memory image of the phone to find the key to unlock bootloader). By using the similar approach as data recovery (linux based), we might be able to recover files data from the phone.
If you seriously need data you might talk to this group of people (https://hcu-client.com/) and see if they could dump all data from the phone using their repair kit.
Click to expand...
Click to collapse
But his phone is not bricked.. they just deleted photos.. and god knows when and they already been using phone for long time .. so it is already overwritten
PhoneTechShop said:
But his phone is not bricked.. they just deleted photos.. and god knows when and they already been using phone for long time .. so it is already overwritten
Click to expand...
Click to collapse
Phone has been switched off that night immediately, after the test to recovery through standard software failed...
kidamnesiac said:
Hi Guys,
yesterday my wife was deleting a couple of pictures from the gallery, and suddently the phone started deleting all of them.
I trust her in saying she didn't select them all since she also told me that the screen was displaying "deleting 3 elements".
She was fast enough to power down the phone but nevertheless all pictures are gone.
I tried with some tool found on the web but said tools were not able to recover any deleted pictures.
It's a non rooted phone, everything stock, 6 months device.
It's just for the value of the pictures of our kid inside of the phone that I'm writing here and yes I know backup should have been made, but alas they were not made...
We recovered something through friends and whatsapp but most are gone.
If anyone has some idea please I'm all ears
Best regards and thanks to you all, it's a great community
Click to expand...
Click to collapse
Hi, I thought that it happened to me only. The same thing happened to me 4 days ago, I tried to delete 1 photo and it has deleted the entire gallery
And in recently deleted trash there was nothing
I used DiskDigger from Play Store but I only recover deleted photos before the system deleted the entire gallery
This I suppose is a serious failure in rom 9.1.0.300
It also happened to another person who removed the entire gallery just by deleting Facebook photos from the gallery on Rom 9.1.0.310
Hopefully, huawei will solve that serious mistake soon.
Google translator
firu.26 said:
Hi, I thought that it happened to me only. The same thing happened to me 4 days ago, I tried to delete 1 photo and it has deleted the entire gallery
And in recently deleted trash there was nothing
I used DiskDigger from Play Store but I only recover deleted photos before the system deleted the entire gallery
This I suppose is a serious failure in rom 9.1.0.300
It also happened to another person who removed the entire gallery just by deleting Facebook photos from the gallery on Rom 9.1.0.310
Hopefully, huawei will solve that serious mistake soon.
Google translator
Click to expand...
Click to collapse
I wasn't even on the latest 9.1 but still on 9.0 Version, but I see I'm not the only one in this situation. I'm trying to get in touch with Huawei but no luck so far other than "sorry for what happened... "
I just want to inform you that while copying leftovers files in preparation for hard resetting the phone I stumbled upon a folder named "recycled" inside a folder named ".Gallery2" inside "Pictures". All our lost pictures and videos were there, just without extensions and with some weird random names.
It's time for me to write a script to rename the files but we're glad that we've got our memories back!
kidamnesiac said:
I just want to inform you that while copying leftovers files in preparation for hard resetting the phone I stumbled upon a folder named "recycled" inside a folder named ".Gallery2" inside "Pictures". All our lost pictures and videos were there, just without extensions and with some weird random names.
It's time for me to write a script to rename the files but we're glad that we've got our memories back!
Click to expand...
Click to collapse
So how did you do it?
You might have some corrupted like you will see half of the picture
---------- Post added at 07:36 ---------- Previous post was at 07:32 ----------
firu.26 said:
Hi, I thought that it happened to me only. The same thing happened to me 4 days ago, I tried to delete 1 photo and it has deleted the entire gallery
And in recently deleted trash there was nothing
I used DiskDigger from Play Store but I only recover deleted photos before the system deleted the entire gallery
This I suppose is a serious failure in rom 9.1.0.300
It also happened to another person who removed the entire gallery just by deleting Facebook photos from the gallery on Rom 9.1.0.310
Hopefully, huawei will solve that serious mistake soon.
Google translator
Click to expand...
Click to collapse
I hink guys when u thought u only deleting one u will hold finger on pic and it will mark it
And you marked all..
Still don't understand how some or how this happened when we have recycle bin.. Where you can restore files... ?
PhoneTechShop said:
So how did you do it?
You might have some corrupted like you will see half of the picture
---------- Post added at 07:36 ---------- Previous post was at 07:32 ----------
I hink guys when u thought u only deleting one u will hold finger on pic and it will mark it
And you marked all..
Still don't understand how some or how this happened when we have recycle bin.. Where you can restore files... ?
Click to expand...
Click to collapse
honestly I did nothing special, once connected to the computer in MTP mode I started transferring the content of the memory just for the sake of what was left, but then to my shocking surprise I found that a folder named ".Gallery2" (thus hidden in android I guess) was inside the pictures folder with lots of content in it.
I then used bunch of powershell code found online to rename the files using the last modified time which was consistent to when the picture was created on the device.
I ended up having to guess based on the dimension if it was JPG or MP4, then manually changed the extension on the wrong ones.
The result is 2201 pictures recoverd and 218 videos recovered. A bunch of the files were corrupeted as you said, but overall I'm glad of the outcome. Phone has been factory reset and now it's serving again as primary driver. this time amazon photos is on by default just in case!
kidamnesiac said:
honestly I did nothing special, once connected to the computer in MTP mode I started transferring the content of the memory just for the sake of what was left, but then to my shocking surprise I found that a folder named ".Gallery2" (thus hidden in android I guess) was inside the pictures folder with lots of content in it.
I then used bunch of powershell code found online to rename the files using the last modified time which was consistent to when the picture was created on the device.
I ended up having to guess based on the dimension if it was JPG or MP4, then manually changed the extension on the wrong ones.
The result is 2201 pictures recoverd and 218 videos recovered. A bunch of the files were corrupeted as you said, but overall I'm glad of the outcome. Phone has been factory reset and now it's serving again as primary driver. this time amazon photos is on by default just in case!
Click to expand...
Click to collapse
But how what software in Windows did you use.. It sounds weird..
Whatever you done u got it....
Congratulations.
Can you post detail (i.e., with picture), explain how to get them back so this will be useful for other people?
kidamnesiac said:
honestly I did nothing special, once connected to the computer in MTP mode I started transferring the content of the memory just for the sake of what was left, but then to my shocking surprise I found that a folder named ".Gallery2" (thus hidden in android I guess) was inside the pictures folder with lots of content in it.
I then used bunch of powershell code found online to rename the files using the last modified time which was consistent to when the picture was created on the device.
I ended up having to guess based on the dimension if it was JPG or MP4, then manually changed the extension on the wrong ones.
The result is 2201 pictures recoverd and 218 videos recovered. A bunch of the files were corrupeted as you said, but overall I'm glad of the outcome. Phone has been factory reset and now it's serving again as primary driver. this time amazon photos is on by default just in case!
Click to expand...
Click to collapse
PhoneTechShop said:
But how what software in Windows did you use.. It sounds weird..
Whatever you done u got it....
Click to expand...
Click to collapse
I did not use any recovery software, just plain Windows Explorer.
When I connected the phone for the last time before the factory reset, I selected MTP, then opened the android device folder with windows explorer and copied the content of the "Pictures" folder on the pc.
Once the folder was done copying, I noticed that a ".Gallery2" folder and inside that folder a "recycle" folder and inside the whole lot of files.
But really, I did nothing more than copying.
And I can confirm that the recycle bin on the device was empty (no file was present), and when using recovery software no file was detected on the device.
jskasia said:
Congratulations.
Can you post detail (i.e., with picture), explain how to get them back so this will be useful for other people?
Click to expand...
Click to collapse
I'm afraid I read your post after deleting the folder from the pc (when I finished renaming all the files, I removed the original recovered folder)
I can try to reconstruct the process and post some screenshots asap
kidamnesiac said:
I did not use any recovery software, just plain Windows Explorer.
When I connected the phone for the last time before the factory reset, I selected MTP, then opened the android device folder with windows explorer and copied the content of the "Pictures" folder on the pc.
Once the folder was done copying, I noticed that a ".Gallery2" folder and inside that folder a "recycle" folder and inside the whole lot of files.
But really, I did nothing more than copying.
And I can confirm that the recycle bin on the device was empty (no file was present), and when using recovery software no file was detected on the device.
Click to expand...
Click to collapse
So you said u didn't use recovery software and in last of your message u saying u been using recovery software???
Hello, there is my problem with OP9 Pro – phone was stuck with some bug and only way to fix it was Wipe Data. Now it's ok, but I do really need to restore photos and videos. Phone is NOT rooted.
After reading tons of information I'm not sure that it's possible to get data back. As I understand I need to follow next steps:
1. Unlock bootloader without wiping data again in order not to lose old structure.
2. Root device, or at least temporary root it.
3. Use some tools to search and restore photos.
But now I'm not sure that everything would be fine. Even the first step is not 100% guarantee that it's possible to avoid data wiping.
So, If there are someone who understand this better, could you please advice me what should I do? Should I waste tons of time or it's muck more likely impossible to do?
Thanks!
mrGenry said:
Hello, there is my problem with OP9 Pro – phone was stuck with some bug and only way to fix it was Wipe Data. Now it's ok, but I do really need to restore photos and videos. Phone is NOT rooted.
After reading tons of information I'm not sure that it's possible to get data back. As I understand I need to follow next steps:
1. Unlock bootloader without wiping data again in order not to lose old structure.
2. Root device, or at least temporary root it.
3. Use some tools to search and restore photos.
But now I'm not sure that everything would be fine. Even the first step is not 100% guarantee that it's possible to avoid data wiping.
So, If there are someone who understand this better, could you please advice me what should I do? Should I waste tons of time or it's muck more likely impossible to do?
Thanks!
Click to expand...
Click to collapse
If you are not bootloader unlocked right now. All hope is lost since unlocking will force a wipe of data that can't be stopped.
MrSteelX said:
If you are not bootloader unlocked right now. All hope is lost since unlocking will force a wipe of data that can't be stopped.
Click to expand...
Click to collapse
I just wiped phone and restored some latest backup (which did not contain media ofc). I was reading about scenario, when we can backup current system, patch it somehow, unlock bootloader and keep old data somehow in place. But it looks so unstable for me.
The folder structure was destroyed when the data was deleted. Although the files still exist -if- they haven't been overwritten, they would be completely juxtaposed. A vast sea of files that could only be sorted by size and file type. No associated time stamps, exif data, original file names and no way to restore it. Let that sink in for a moment.
Just recovering a flash card with a 100 images on it and then trying to sort them is a major headache unless you have a photographic memory. The files names are gone. The recovered images will have a new assigned number generated that is unrelated to the file's original name. Now imagine trying to do that with a 100gb jigsaw puzzle from hell.
Always redundantly backup critical data to at least 2 hdds that are physically and electronically isolated from each other and the PC.
blackhawk said:
The folder structure was destroyed when the data was deleted. Although the files still exist -if- they haven't been overwritten, they would be completely juxtaposed. A vast sea of files that could only be sorted by size and file type. No associated time stamps, exif data, original file names and no way to restore it. Let that sink in for a moment.
Just recovering a flash card with a 100 images on it and then trying to sort them is a major headache unless you have a photographic memory. The files names are gone. The recovered images will have a new assigned number generated that is unrelated to the file's original name. Now imagine trying to do that with a 100gb jigsaw puzzle from hell.
Always redundantly backup critical data to at least 2 hdds that are physically and electronically isolated from each other and the PC.
Click to expand...
Click to collapse
Yeah, thanks! Really, there is nothing critical, just default amount of family photos and videos (phone is my father's, I'm just investigating possibility of recovering).
And tons of different information is all across the web. Also, latest Android 12 is pretty new and I guess lots of articles are not suite for that phone.
So, I guess it's too overwhelmed even to try root phone and search files. Maybe, data value is lower that possibility to turn phone into a brick.
mrGenry said:
Yeah, thanks! Really, there is nothing critical, just default amount of family photos and videos (phone is my father's, I'm just investigating possibility of recovering).
And tons of different information is all across the web. Also, latest Android 12 is pretty new and I guess lots of articles are not suite for that phone.
So, I guess it's too overwhelmed even to try root phone and search files. Maybe, data value is lower that possibility to turn phone into a brick.
Click to expand...
Click to collapse
If you want the best possible outcome take it to a data recovery specialist. That's all they do.
Don't use any apps like FoneDoctor, they will find stuff but encrypt the drive $o only that app can unencrypt it.
blackhawk said:
If you want the best possible outcome take it to a data recovery specialist. That's all they do.
Don't use any apps like FoneDoctor, they will find stuff but encrypt the drive $o only that app can unencrypt it.
Click to expand...
Click to collapse
Thanks! A bit upset, but Im great to get useful information.
mrGenry said:
Thanks! A bit upset, but Im great to get useful information.
Click to expand...
Click to collapse
Losing critical data is never pretty.
I've lost a database with decades of data on it. The only way to help prevent this is redundant backups.
Perhaps your father had backup them up deliberately or by happenstance to a PC or other device.