# Is it possible to use Autopsy to recover files from Android internal memory? **URL:** \ **Category:** Autopsy Help\ **Created:** [July 21, 2021, 1:58pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735 "2021-07-21T13:58:59Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![R23](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@R23](https://sleuthkit.discourse.group/u/R23)\ **Post date:** [July 21, 2021, 1:58pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/1 "2021-07-21T13:58:59Z")
I’m the IT guy at my company and I just deleted a 3GB “Msgstore db Crypt” file from the CEO’s smartphone. So I have to recover as many files as possible as quickly as possible. ---
**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\ **Post date:** [July 22, 2021, 4:39pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/2 "2021-07-22T16:39:11Z")
Your question is too vague (what’s the device make/model, android version, application, etc.), so I can only answer generally. Autopsy cannot extract contents of Android storage devices. If you can extract a physical volume from an android device with another tool, Autopsy **can** read many file systems commonly in use and carve from unallocated space. However, modern Android devices use encryption and extracting decrypted volumes isn’t possible, though copying logical files _can be_. Your question seems to contemplate recovering a deleted database. This is not likely possible if the Android device is modern and uses a modern Android version (generally 7+) with encryption (default on 8+). There are caveats to almost all of what I’ve said, but like I stated in the beginning, this is a general response. ---
**Author:** ![R23](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@R23](https://sleuthkit.discourse.group/u/R23)\ **Post date:** [August 7, 2021, 11:55am UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/3 "2021-08-07T11:55:18Z")
Thanks for your response! I have a Zenfone 4 with Android 8. With factory settings. I used it exclusively for whatsapp, but when I installed Whatsapp Businnes by accident all my old Whatsapp folders were deleted. Photos, audios, media, etc. Backups did not work. So I would like to try to recover as many files as possible, if possible with the same names and location. ---
**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\ **Post date:** [August 7, 2021, 4:50pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/4 "2021-08-07T16:50:26Z")
To recover a deleted (previously existing) file (don’t confuse this for a deleted _record_ in an _existing_ database file), you need access to physical storage. By software, this means a rooted device. By hardware, this means removing the storage chip or connecting to it through a technique as In-Service-Programming (sort of like hot-wiring a car). This allows you to copy allocated (existing files) and unallocated (previously used and unused storage) blocks. But don’t get too excited. With Android 8, you are almost always dealing with encryption, either file-based or full-disk. This means content of deleted files can’t be decrypted because the encryption keys are lost or are inaccessible. Because of encryption, modern recovery methods focus on finding ways to copy full file systems from booted and unlocked devices (Why booted and unlocked? Because the storage is decrypted in that state). Recovering deleted _files_ is a thing of the past. Your phone was released with Android 7.1 and encryption was hit and miss with that generation of Android OS–some vendors enabled it by default while other’s left it as a user option. It is possible that your storage is not encrypted. However, even if encryption isn’t a factor, recovering a complete, well populated database like WhatsApp is unlikely due to fragmentation. NAND flash memory is made up of pages, and every change to a page, e.g., to commit a message to a database table, requires that the page be read into RAM, altered, and written to a new page. The old page is the flagged as “dirty” and eventually zero’d and flagged for reuse in a process known as garbage collection. Because of the files systems in use on Android, you can’t simply read the file system structures to find the addresses of previously existing files (such file system metadata is wiped when the file is deleted). Thus, you are left with file carving, and there is no carving technique that can recover a complete, fragmented SQLite database. So, while individual database pages might be recoverable and useful for forensic analysis, they aren’t useful for restoring you WhatsApp application to it’s pre-deletion, working condition. Your experience with Android Backup is not atypical. Android Backup doesn’t backup _all_ files on an Android Device. Instead, it stores those files _flagged for backup_ by the operating system and those _allowed by software developers_. WhatsApp developers can simply choose not to allow the chat database to be included in a backup, and this may be a legitimate security choice, even if you now find it inconvenient. None of this solves your problem, other than to say you are unlikely to restore WhatsApp messages to your phone. My hope was that this response would help you and others similarly trying to recover data from Android devices understand the dynamics involved. ---
**Author:** ![R23](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@R23](https://sleuthkit.discourse.group/u/R23)\ **Post date:** [August 7, 2021, 5:52pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/5 "2021-08-07T17:52:47Z")
> [@John\_Lehr](#): > > other than to say you are unlikely to restore WhatsApp messages to your phone. My hope was that thi So is it possible or not? ---
**Author:** ![John\_Lehr](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/john_lehr/32/45_2.png) [@John\_Lehr](https://sleuthkit.discourse.group/u/John_Lehr)\ **Post date:** [August 7, 2021, 8:43pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/6 "2021-08-07T20:43:30Z")
I answered you as you have observed by your quote. It’s the best I can give with the information I have. ---
**Author:** ![R23](https://avatars.discourse-cdn.com/v4/letter/r/df705f/32.png) [@R23](https://sleuthkit.discourse.group/u/R23)\ **Post date:** [August 8, 2021, 12:27pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/7 "2021-08-08T12:27:31Z")
I’m sorry but I didn’t understand what you said. Was your answer YES or NO? ---
**Author:** ![Ian\_Mwangi](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/ian_mwangi/32/2145_2.png) [@Ian\_Mwangi](https://sleuthkit.discourse.group/u/Ian_Mwangi)\ **Post date:** [February 10, 2025, 11:19pm UTC](https://sleuthkit.discourse.group/t/is-it-possible-to-use-autopsy-to-recover-files-from-android-internal-memory/2735/8 "2025-02-10T23:19:39Z")
Same to me. I NEVER understood anything about what was discussed. Plz reduce lots of speech and give a straight forward answer mehn​:relieved:😌 If am to try and help out, I’ve never used autopsy to recover files from an Android phone. But from my research, I saw that if u connect your phone to your PC wlvis your USB and turn on File transfer mode, then it will scan your device and get files to be recovered. Good thing there’s android analyzer in autopsy. So combining that android analyzer plus other ingest modules(You find them after following the screen options i.e, after creating your new case) you give it several hrs for it to finish the process. I did my file recovery from my usb 2.0 yesterday and it took 3 full hrs to finish the whole recovery process. So for an Android phone maybe it may take longer.