My phone (sk17i ) did a hard reset with a full wipe of the sd card contents. Do not know how this happened. I was at 10 percent battery, i just pressed the button on top and it just restarted and now the sd card is wiped clean but i do have my google account on the phone. This is stock firmware , stock rom , rooted with blocked bootloader, only modifications are systemui and quickpanel ( colored ) . Other root applications are Xperia Cwm Auto Installer and titanium backup. Is there a log i can look into to see what happened ?
kasmq said:
My phone (sk17i ) did a hard reset with a full wipe of the sd card contents. Do not know how this happened. I was at 10 percent battery, i just pressed the button on top and it just restarted and now the sd card is wiped clean but i do have my google account on the phone. This is stock firmware , stock rom , rooted with blocked bootloader, only modifications are systemui and quickpanel ( colored ) . Other root applications are Xperia Cwm Auto Installer and titanium backup. Is there a log i can look into to see what happened ?
Click to expand...
Click to collapse
I think there isn't any log for that action.
Are you sure you didn't doing something with your SK17i before it got fully wiped..??
By default, there is no background logging process in order to have better performance and battery life.
I did not do anything . i was just checking the battery life. so i opened the phone looked at the 10% of battery that i had left and closed it. Now- any good sd card data restoring software anybody can help me with. I need a good one , and i tried 4 until now and i can't seem to find anything on that sd card.
If the SDcard was formatted, then there is only a very small chance to restore anything.
From Wikipedia
As in file deletion by the operating system, data on a disk are not fully erased during every[17] high-level format. Instead, the area on the disk containing the data is merely marked as available, and retains the old data until it is overwritten. If the disk is formatted with a different file system than the one which previously existed on the partition, some data may be overwritten that wouldn't be if the same file system had been used. However, under some file systems (e.g., NTFS, but not FAT), the file indexes (such as $MFTs under NTFS, inodes under ext2/3, etc.) may not be written to the same exact locations. And if the partition size is increased, even FAT file systems will overwrite more data at the beginning of that new partition.
From the perspective of preventing the recovery of sensitive data through recovery tools, the data must either be completely overwritten (every sector) with random data before the format, or the format program itself must perform this overwriting, as the DOS FORMAT command did with floppy diskettes, filling every data sector with the byte value F6 in hex.
However there are applications and tools, especially used in forensic information technology, that can recover data that has been conventionally erased. In order to avoid the recovery of sensitive data, governmental organization or big companies use information destruction methods like the Gutmann method or the DoD 5220 of the National Industrial Security Program[18]. For average users there are also special applications that can perform complete data destruction by overwriting previous information. Although there are applications that perform multiple writes a single write is generally all that is needed on modern hard disk drives.
Click to expand...
Click to collapse
From my personal experience i restore from my sd card in photocamera (fat32 like here) few 5 years photo even when i using this camera. Its becouse theses jpg files wasnt ovewrited with other. But that program was especialy designed for photo files only.
My point is i thing there is bigger chance just keep away from formating and ofc make restoring to your hard drive
Sent from my ST15i using XDA
So - for photos i used East Imperial Soft Magic Photo Recovery - did a great job, except it changed the names of the photos .
And for the other files i'm using EASUS data recovery wizard -this is the best thing ever. It recognized a ton of files and right now i'm restoring all my files.
Related
Are there any deep erasing apps out there that can zero the bytes or perform dod style erase methods? I'm trying to erase the internal memory (not the microsd) of the phone. How can I make sure its not recoverable when selling it?
Its just that it contains work related information that I wouldn't want someone trying to recover if they happen to be that type of person.
Ι guess, reflashing it should do the job, and then just mess around with install-uninstall applications, a lot!
The only way to recover data from phone memory if deleted is with taking phone apart and taking flash memory out(this includes melting down pins). And than put this flash on some other circut board.
Just so that you know how hard is it, enough for most people.
For exstremist what the poster before me said, writing and deleting many times. You could do that on rootet phone with some root explorer program. If you didn use custom ROMs you only need to take care of /data partition, if you did flash a bit DATA partition can move maybe(no sure) so you should do same for /system. Flashing ROM writes to some of system partition, the remainder fill it us with some trash files and to again
I heard 20 times is what makes it 100% FBI secure. But 2 times should make it 99.999% secure anyway
Edit: That 20 number is for hard drives with same special machines. I am not sure how it is with flash, maybe one rewrite makes it totaly unrecoverable already. If you only worried for softwere recovery once is enough.
I will also give an example. Suppose you have some critical info on your SD card. If you delete that info, you can't rest assured that your critical info has been deleted. Because system just shows it has been deleted. Until something else fills up the same sectors /space on your card, it wont be permanently deleted. But now, if you fill up your whole SD card with, say, videos and songs, then your critical info is really gone. Though simpler solution to do this is to format the SD card.
Same applies for internal memory. You must flash a new rom and fill the data space fully with other apps. Do it without activating/logging in your gmail. Once it's done, you can reflash it with wiping everything from recovery and give/sell to someone as a fresh phone.
In other words fill ur SD with trash,.
I haven't rooted the phone yet. If I do root just to flash a rom and fill space, will I be able to flash back the original rom and make it so that it was never rooted in the first place?
i wud "dd" all my phone's partition in recovery mode(manually mount them use df in normal mode to know wats mounted) and then flash stock rom using that kdz thing...
PS ..u cud also "dd" your sdcard using
dd if=/dev/random of=/dev/sdb bs=5M count=1000
(/dev/sdb is assumed as your sdcard drive )
5M*1000=5000MB wiped multiply acc to your card's capacity
beastfromtheeast said:
I haven't rooted the phone yet. If I do root just to flash a rom and fill space, will I be able to flash back the original rom and make it so that it was never rooted in the first place?
Click to expand...
Click to collapse
Yes flashing some original ROM with KDZ (there is a thread with instructions somewhere) makes it like it was from the factory.
You r not rooted. In this case:
1.factory reset.
2.install futile apps till your internal memory is full.
3.factory reset again and you are done.
is there any way to install apps without adding a google account and d/l from the market?
yes
download them to your pc
move them to your sd card and install them from there
it would b flashing the new rom alover, of flashing the lg original firmware.
to flash another rom your phone must be rooted and have custom recovery
thanks guys, I flashed the stock rom with kdz then installed futile apps via adb until I couldn't install anymore (adb error when phone hit the 20mb mark). One hard reset later, I think its good to go.
shredroid
i have another gmail address that i use for signing up to websites that might start sending me junk. after ive reset the phone i just add that account to the phone and can get access to the market that way without messing up my other main google account settings... then use Shredroid to give the internal memory a good wipin'.
i never tried the other way but using shredroid sounds way quicker that installing apps until youve filled the internal memory, especially if you have a phone with a lot of it
ategtre sky
sarfaraz1989 said:
i wud "dd" all my phone's partition in recovery mode(manually mount them use df in normal mode to know wats mounted) and then flash stock rom using that kdz thing...
PS ..u cud also "dd" your sdcard using
dd if=/dev/random of=/dev/sdb bs=5M count=1000
(/dev/sdb is assumed as your sdcard drive )
5M*1000=5000MB wiped multiply acc to your card's capacity
Click to expand...
Click to collapse
is there actually a dd binary in recovery mode / android at all?
The other day the phone seems to have just reset itself without user interaction. All apps and contacts and such are gone but the device memory is full (10mb free after clearing cache and doing delete dumpstate/logcat). The phone memory was also quite full before this happened. Before I perform a factory reset I wanted to ask if it's possible that the data is still there and could be recovered by rooting the phone or something.
Are the chances of recovering anything so low I might as well just do the reset? I'm also worried that the the low amount of available memory is a problem with rooting - is this a valid concern?
The phone is an GT-I9100 with stock Android 4.1.2 (not rooted)
Thanks in advance
So I rooted the phone and can now access the data on the phone using adb. However, I don't know how to copy e.g. the data folder to my computer or the usb memory because "cp" isn't recongnized and I'm not able to install busybox (or a file explorer) on the phone because of insufficient memory. I also can't seem to use adb pull to get the folders (adb pull /data/data outputs "0 files pulled, 0 files skipped").
EDIT: /data/lost+found seems to be taking all the space and looks like the lost data is there. After deleting some files I was able to install busybox and copy the folder where I can access it.
EDIT2: I indeed seem to be able to restore the data (so far tried with mini diary and was succesful) so I'll mark this as solved.
If you've got files in lost+found, they're there because the on-boot filesystem check, fsck, put them there because it found the filesystem to be corrupt. Best thing is to factory wipe as there may still be lurking errors. If it keeps happening, your phone's flash is probably defective (either worn out from use, or manufactured that way) like that in my i9100.
Sent from my Nexus 7 using Tapatalk
Hi 2 all,
Forgot to make nandroid and unlocked bootloader on my wife's m8. And 27GB of photos gone. I think she'll kill me after she wake up in the morning. Is there any way to get data back?
Unlocking the bootloader is not supposed to do that. It will wipe user data (/data partition) but I believe the internal storage ("virtual SD") should have been untouched. So you shouldn't blame yourself too much. And a nandroid would not have helped you as not only is that partition not backed up with a nandroid, but the default location for a nandroid is the internal SD, so it would have been lost, anyway.
That said, I try to backup any important personal data (even on partitions that are not supposed to be impacted) to my computer whenever doing something major like flashing a ROM or unlocking the bootloader. Only reason I've started doing that is a similar bug on the One X (EVITA) where actions that are not supposed to wipe the internal memory, occasionally did so (which is what I suspect happened to you).
I think your only hope is to use data recovery programs (Recova is a free one). But I've had mixed results doing so (and have seen similar reports here) when trying to recovery photos and other data that were "accidentally" deleted or recovered. Its certainly worth a try, and also keep in mind that you should do so ASAP as the more you use your phone, the higher the chance that those memory sectors where the photos were saved will be overwritten by other data.
Also, is there anything left on the internal memory at all when you browse with a file manager? Sometimes, corrupted data will be saved to a folder named LOST.DIR and there have times where folks have often found many of their photos simply moved there.
Found very helpful post
http://forum.xda-developers.com/galaxy-nexus/general/guide-internal-memory-data-recovery-yes-t1994705.
For M8 it works pretty much the same. I was able to get userdata partition from the phone, but because of I converted to GPE I lost everything. So I'm 99% sure that it will work right after unlock bootloader and factory reset.
exbarboss said:
Found very helpful post
http://forum.xda-developers.com/galaxy-nexus/general/guide-internal-memory-data-recovery-yes-t1994705.
Click to expand...
Click to collapse
Ah, that's true. I hadn't thought about the fact that the memory mounts as MTP now. The times I did the data recovery was on the old bulk storage mode on my One X (before it was switched to MTP). All I had to do was connect my phone to my PC and run Recuva.
Mind you, even mounted properly, data recovery programs will not always be able to recover all data. It was pretty hit or miss for me (and from other reports I've seen). But the linked method is also clever in that it makes a copy of the corrupted partition to your computer, so you sidestep the issue that those sectors may be overwritten as the phone is being used. Give you more times to try various data recovery apps, etc.
redpoint73 said:
Ah, that's true. I hadn't thought about the fact that the memory mounts as MTP now. The times I did the data recovery was on the old bulk storage mode on my One X (before it was switched to MTP). All I had to do was connect my phone to my PC and run Recuva.
Mind you, even mounted properly, data recovery programs will not always be able to recover all data. It was pretty hit or miss for me (and from other reports I've seen). But the linked method is also clever in that it makes a copy of the corrupted partition to your computer, so you sidestep the issue that those sectors may be overwritten as the phone is being used. Give you more times to try various data recovery apps, etc.
Click to expand...
Click to collapse
Yeah I tried Recuva, WinHex, R-Studio - nothing helped. I looked at low level data with WinHex and most sectors were zeroed...
Tennor1 said:
Just try for a sd card data recovery
Click to expand...
Click to collapse
Maybe I'm missing something, but I don't understand what is being referred to here. Can you clarify or give more detail?
Hello Guys, i have been attempting to flash the phone , but it doesnt go in flashmode ( i know it's volume down when plugging to usb ), but nothing happen with flashtool, any idea ?
Maybe driver, but it looks like the phone still in fastboot, and it s reconized by flashtool with the build number and kernel . i don t know how to go to this flashboot mode.
thank you
So one of my phone's android just stopped working for no reason AFAIK, and so now it's luck in a infinite boot, so i tried to backup user data in an attempts to recover my internal storage, got 6 backup files, merged them into a .ext4 using this tutorial https://www.youtube.com/watch?v=cY4cKKimEFU, but it's won't open once in windows using 7z, stating "cannot open the file as [Ext] archive"
so i'm basically stuck now, and i can't just wipe my phone's data either cause i'll loose all my 2FA apps.
edit:
userdata store apps, files, encryption key used for sd when formatted as internal storage and other things like contacts...
See here: https://trenovision.com/how-to-read-ext4-partitions-on-windows/
jwoegerbauer said:
See here: https://trenovision.com/how-to-read-ext4-partitions-on-windows/
Click to expand...
Click to collapse
already tried these in the past for other purposes, never worked, tried again, and nope, i can see the folder, but i can't the their content, an error pop up
so i have couple thing to say,
first, i reinstalled android using the tool provided by the manufacturer.
second, i had my backup file, made while stuck in infinite boot, restored user data via recovery mode, my apps are back, my data, videos and all that stuff are back, my sd card, formatted as internal storage is back.
2FA apps are backs, codes are still available, everything is working!
so i know those things are stored within the user data backups, i still don't know how to unpack them properly though
Hi all
I have a Samsung S20 Ultra with a memory card that all of my photos are saved to, unfortunately I had to take my phone into Samsung experience store for a screen / back cover repair, the staff removed my Memory card and told me to factory reset due to GDPR as the device had to be sent away, when my device returned in the post 5 days later I went to put the memory card back in and a notice appeared stating the memory card is encrypted to a different device! I am totally devastated as there are pictures of my father who has passed away and other images that they are the only copies I have, I know now I should have unencrypted the memory card before the factory reset. I have spoken to Samsung directly so say there is nothing that can be done.
does anyone know of a way I can get round this I would be so very grateful!
Thanks in advanced
Stu
The best thing I could suggest is a third party solution that may be able to decrypt the information on the card, such as FeExplorer. Check to see if you have a "Decrypt SD card" option in the Lock Screen and Security settings, although I suspect it won't be able to do it.
The problem is, the encryption key is unique and stored in user data. When data is wiped during a factory reset, the key is wiped as well, so even if the user configures the same lock settings (password, pattern, etc) they key would be different.
I am not aware of an absolute solution, but here is what I would strongly suggest you do:
If able, make sure the contents of the card are backed up. Use cloud storage such as Google Drive.
Keep the card in a safe place; maybe put it in a small envelope or something, and mark it in such a way as to discourage accidental discarding or wiping.
Buy a new SD card to use in the meantime while you look for a way to recover the information on the encrypted card.
I am sorry for your loss, and I wish I had a better answer for you.
Edit: Found this on another site, maybe it's worth a try. MAKE SURE YOU BACK UP THE DATA ON THE CARD IN CASE THIS GOES WRONG.
On a PC: Copy (the encrypted and unreadable) contents of the sd card from the phone to your harddrive
On the phone: Settings -> Storage -> Sd Card -> Format sd card (this erases all the data on the sd card but don't worry you have a copy on the PC)
On the phone: Settings -> Security -> Encrypt sd Card (should be real fast since it's an empty sd card)
On the PC: Copy the contents of the sd card onto the phone
On the phone: Settings -> Security -> Decrypt sd card (edit: this may take a while depending on how much data was on the card)
sorry but none of the above "solutions" makes any sense. it is not possible to recover data. encryption key was located /data/misc/vold and /data itself was encrypted, too. Furthermore one can't access /data aka userdata partition.
BUT... and here comes the but.. adoptable-storage usually is DISABLED in One UI
So how is it possible your MicroSD Card is encrypted at all? It's not, except you have installed custom ROM or installed any 3rd party encryption tool (you would remember)
There is a good chance your MicroSD Card is plain exFAT or Fat32 unencrypted file system. I recommend to use a card reader for PC and make a 1:1 dump with gddrescue and analyze the dump with photorec or other file carver solutions.
There exist tools for windows too, for example
https://www.klennet.com/carver
https://www.z-a-recovery.com
https://www.runtime.org
Don't buy any software if your MicroSD Card is encrypted, it will definitely not work.
You can easily check if your MicroSD Card is encrypted by opening raw disk image with HxD hex editor and search for any plain text or series of zeros. gparted or testdisk will tell you if partition table exist
aIecxs said:
sorry but none of the above "solutions" makes any sense. it is not possible to recover data. encryption key was located /data/misc/vold and /data itself was encrypted, too. Furthermore one can't access /data aka userdata partition.
BUT... and here comes the but.. adoptable-storage usually is DISABLED in One UI
So how is it possible your MicroSD Card is encrypted at all? It's not, except you have installed custom ROM or installed any 3rd party encryption tool (you would remember)
There is a good chance your MicroSD Card is plain exFAT or Fat32 unencrypted file system. I recommend to use a card reader for PC and make a 1:1 dump with gddrescue and analyze the dump with photorec or other file carver solutions.
There exist tools for windows too, for example
https://www.klennet.com/carver
https://www.z-a-recovery.com
https://www.runtime.org
Don't buy any software if your MicroSD Card is encrypted, it will definitely not work.
You can easily check if your MicroSD Card is encrypted by opening raw disk image with HxD hex editor and search for any plain text or series of zeros. gparted or testdisk will tell you if partition table exist
Click to expand...
Click to collapse
when you put an SD card into a Samsung ultra it asks if you want to encrypt it through their own software, no third party apps were used
True, I realized after posting. Samsung is always bit special, they tried to think differently... In that case your data was lost in the moment of factory reset.
https://www.samsung.com/au/support/mobile-devices/how-to-encrypt-decrypt-sd-card
Stu_C said:
Hi all
I have a Samsung S20 Ultra with a memory card that all of my photos are saved to, unfortunately I had to take my phone into Samsung experience store for a screen / back cover repair, the staff removed my Memory card and told me to factory reset due to GDPR as the device had to be sent away, when my device returned in the post 5 days later I went to put the memory card back in and a notice appeared stating the memory card is encrypted to a different device! I am totally devastated as there are pictures of my father who has passed away and other images that they are the only copies I have, I know now I should have unencrypted the memory card before the factory reset. I have spoken to Samsung directly so say there is nothing that can be done.
does anyone know of a way I can get round this I would be so very grateful!
Thanks in advanced
Stu
Click to expand...
Click to collapse
Hello, have an experience that my samsung device were dead and my sd card still encrypted.
Firstly, you have to backup entire data on your sd card just in case.
And then, format your sd card using another device (maybe your another android).
Last, put your sd card to windows device and recover all data with DiskDigger software.
It's work on my sd card, give it a try.. Dont forget to backup all data