The Motorola Bootloader Unlocker wiped my Android 4.4.2 phone; total factory reset.
Sheesh.
Within an hour, I had set the phone in airplane mode, loaded CYGwin and ADB and Fastboot on my Win10 PC, rooted the phone with TWRP and Magisk), installed busybox apk, and then started fiddling with stuff for hours and hours.
I finally got a dd process going: it is transferring a mmcblk0.raw file to my PC.
I may run it again on just the userdata partition /dev/block/mmcblk0p36, to get a smaller file to work with.
This stuff is all new to me as of today. It’s been quite a day!
I need some friendly help on how to use Autopsy and/or TSK on Windows to try to recover jpg’s from what I presume is one huge disk image file transferred from the phone to a folder on my harddrive.
I understand that Trim runs on Android 4.4.2 as often as once every 24 hours. I think there is a chance I succeeded in capturing the whole partition before fstrim ran.
I need some good advice on what to do next, what steps to take, so that I don’t damage this file that I worked so hard to get.
The phone is 16GB memory. Except for system files and OS, the memory is empty due to the factory reset.
The mmcblk0.raw file I transferred to my PC is 14.6GB.
The tutorial I followed to get this file is from 2011.
It’s next steps are to convert the raw file to VHD format and mount it in Windows Disk Manager.
Later contributors to that thread discovered that:
1 - it’s best to capture the entire mmcblk0 partition like what I did, than to try to get only a piece of it.
2 - it’s good if the saved image file is big. Better odds of saving some images.
3 - it’s better to try available tools on the raw file rather than converting it to VHD.
So. I have a big file. I don’t want to screw it up.
This is where my forensic examination / recovery learning curve starts.
How to locate and recover deleted image files in this 14.6MB mirror of a 2013 Android memory partition.
