Recovering deleted media files from phone

Using PhotoRec to recover lost data
Forum rules
When asking for technical support:
- Search for posts on the same topic before posting a new question.
- Give clear, specific information in the title of your post.
- Include as many details as you can, MOST POSTS WILL GET ONLY ONE OR TWO ANSWERS.
- Post a follow up with a "Thank you" or "This worked!"
- When you learn something, use that knowledge to HELP ANOTHER USER LATER.
Before posting, please read https://www.cgsecurity.org/testdisk.pdf
Locked
Message
Author
nomadash
Posts: 2
Joined: 14 Aug 2021, 18:49

Recovering deleted media files from phone

#1 Post by nomadash »

Hello

I accidentally deleted around 50 image and video files on my android phone.

On my linux pc, used adb pull command for the phone's data partition and saved it to the PC as .img file (around 120gigs).
(I identified the partition via using already installed TWRP > Advanced > Terminal > and using 'mount' command to list partitions).

I then used the default settings with photorec with 'Free' setting - no files found.
Then tried 'Whole' setting - a few gzip files (which error on trying to extract).

I'm a newbie and not sure if I'm following the correct procedure. Any advice will be appreciated.

Thanks

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering deleted media files from phone

#2 Post by recuperation »

I am really not good in phone diagnostics!
Your partition may be encrypted, try to verify.

nomadash
Posts: 2
Joined: 14 Aug 2021, 18:49

Re: Recovering deleted media files from phone

#3 Post by nomadash »

Thanks for the reply.

On my phone, when trying to use TWRP it first asks me to decrypt which I do. Though is this different from using adb pull command? That is, it will pull a encrypted partition?

And how would I verify if the partition is encrypted when saved on PC as file.img?

Thanks

recuperation
Posts: 2720
Joined: 04 Jan 2019, 09:48
Location: Hannover, Deutschland (Germany, Allemagne)

Re: Recovering deleted media files from phone

#4 Post by recuperation »

I have no clue.
Please keep in mind that write activity on that partition can erase anything.

I would get a second phone, empty the storage, put in a jpg-file labeled "test.jpg" in there.
I would then export the partition and run Photorec. This test has to be positive, Photorec has to find it.

Next step, only necessary if the step above succeeds:
Delete test.jpg, export the partition and let Photorec search.
If Photorec fails to find the deleted test.jpg the partition is either encrypted or some process has overwritten the data.

Locked