Help noob recover images wiped from phone?

[Dave]

The Motorola Bootloader Unlocker wiped my Android 4.4.2 phone; total factory reset.

Sheesh.

Within an hour, I had set the phone in airplane mode, loaded CYGwin and ADB and Fastboot on my Win10 PC, rooted the phone with TWRP and Magisk), installed busybox apk, and then started fiddling with stuff for hours and hours.

I finally got a dd process going: it is transferring a mmcblk0.raw file to my PC.

I may run it again on just the userdata partition /dev/block/mmcblk0p36, to get a smaller file to work with.

This stuff is all new to me as of today. It’s been quite a day!

I need some friendly help on how to use Autopsy and/or TSK on Windows to try to recover jpg’s from what I presume is one huge disk image file transferred from the phone to a folder on my harddrive.

I understand that Trim runs on Android 4.4.2 as often as once every 24 hours. I think there is a chance I succeeded in capturing the whole partition before fstrim ran.

I need some good advice on what to do next, what steps to take, so that I don’t damage this file that I worked so hard to get.

Thanks!

[Dave]

Hi everyone.

The phone is 16GB memory. Except for system files and OS, the memory is empty due to the factory reset.

The mmcblk0.raw file I transferred to my PC is 14.6GB.

The tutorial I followed to get this file is from 2011.

It’s next steps are to convert the raw file to VHD format and mount it in Windows Disk Manager.

Later contributors to that thread discovered that:
1 - it’s best to capture the entire mmcblk0 partition like what I did, than to try to get only a piece of it.
2 - it’s good if the saved image file is big. Better odds of saving some images.
3 - it’s better to try available tools on the raw file rather than converting it to VHD.

So. I have a big file. I don’t want to screw it up.

This is where my forensic examination / recovery learning curve starts.
How to locate and recover deleted image files in this 14.6MB mirror of a 2013 Android memory partition.

Thanks in advance for tips or suggestions.

Dave

[apriestman]

There are probably other tools, but here’s how I’d do it with Autopsy. This will not alter your raw file.

• Run Autopsy, make a new case, and add your mmcblk0.raw file as a disk image (see http://sleuthkit.org/autopsy/docs/user-docs/4.13.0/quick_start_guide.html and other documentation for more information)
• Run the File Type (http://sleuthkit.org/autopsy/docs/user-docs/4.13.0/file_type_identification_page.html) and PhotoRec (http://sleuthkit.org/autopsy/docs/user-docs/4.13.0/photorec_carver_page.html) ingest modules
• Look in the tree under Views->File Types to see if your jpgs are in there. You can
  also browse through your data source to see if any of your deleted folders/files are in there. (http://sleuthkit.org/autopsy/docs/user-docs/4.13.0/tree_viewer_page.html)
• If you find any files, you can extract them by right-clicking on them in the results viewer and selecting “Extract File(s)”. (http://sleuthkit.org/autopsy/docs/user-docs/4.13.0/result_viewer_page.html)

[Dave]

Thank you!

It’s the little things that help, like where to start, and whether any of my actions will mess up the file.

I’ll take a crack at it this weekend.

Dave