cgsecurity.org

Hello

I accidentally deleted around 50 image and video files on my android phone.

On my linux pc, used adb pull command for the phone's data partition and saved it to the PC as .img file (around 120gigs).
(I identified the partition via using already installed TWRP > Advanced > Terminal > and using 'mount' command to list partitions).

I then used the default settings with photorec with 'Free' setting - no files found.
Then tried 'Whole' setting - a few gzip files (which error on trying to extract).

I'm a newbie and not sure if I'm following the correct procedure. Any advice will be appreciated.

Thanks

I am really not good in phone diagnostics!
Your partition may be encrypted, try to verify.

Thanks for the reply.

On my phone, when trying to use TWRP it first asks me to decrypt which I do. Though is this different from using adb pull command? That is, it will pull a encrypted partition?

And how would I verify if the partition is encrypted when saved on PC as file.img?

Thanks

I have no clue.
Please keep in mind that write activity on that partition can erase anything.

I would get a second phone, empty the storage, put in a jpg-file labeled "test.jpg" in there.
I would then export the partition and run Photorec. This test has to be positive, Photorec has to find it.

Next step, only necessary if the step above succeeds:
Delete test.jpg, export the partition and let Photorec search.
If Photorec fails to find the deleted test.jpg the partition is either encrypted or some process has overwritten the data.