So Super Wipe Lite had completely decimated the data partition of my Asus Eeepad Transformer TF-101 Android tablet, effectively wiping out all my photos. Here’s how I managed to get them back.
Hopefully this blow by blow account of my data recovery effort may help anyone who finds themselves in a similar predicament. The results of your recovery largely depends your old data still being intact and not yet overwritten by new data.
First, some prerequisites.
- Your tablet needs to be rooted. If you’re tinkering around with partitions getting formatted, there’s a good chance you’ve got root too.
- Some sort of terminal emulator that allows you to do dd. I used Terminal Emulator.
- PhotoRec software on your desktop.
- An external storage drive large enough to contain the partition that you’re recovering from. I had an old external HDD that I hooked up to the Transformer via the USB port on the keyboard dock.
An overview of the procedure.
- We’ll make a raw dump of the wiped partition so we can perform the recovery from a desktop computer.
- We’ll use PhotoRec to do a low-level scan of the data to look for signature of files, and recover them.
Now step by step:
Part I: Low-level copy of the partition
1. On your android tablet, open Terminal Emulator.
2. Go superuser by typing
su. Grant SuperUser permissions to the Terminal Emulator when prompted.
mount. This lists all the partitions on your system. Look for a line that says something like /data, which was the folder that contained all my lost data.
/dev/block/mmcblk0p7 /data ext4 rw,nosuid,nodev,noatime,user_xattr...
Basically we’re wanting to find out what the corresponding block device is. In my case, it was
4. From that same list, you can also figure out where your external HDD is mounted. Mine looked something like this:
/dev/block/vo1d/8:5 /Removable/USBdisk2/Drive3 tntfs rw,relatime, uid=0...
If the partition you’re wanting to recover is larger the 4GB, make sure you use something like NTFS or ext3/4. FAT simply won’t cut it.
5. With all the information gathered above, we’ll do a the dump like this
dd if=/dev/block/mmcblk0p7 of=/Removable/USBdisk2/Drive3/transformer-recovery.img
Sit back and relax for a moment. Mine took around 20 minutes for a 15GB dump. When it is finished, you’ll be returned to the prompt.
Part II: Recovering the files using PhotoRec
1. Now that we’ve got a low-level copy of the partition, plug the external hard drive into a desktop computer where you can run PhotoRec.
2. Fire up PhotoRec. Because PhotoRec is only able accept actual partitions as targets for low level scanning, we’ll play a trick where we point it at the partition containing the image file
3. When asked about the filesystem type, pick
4. When asked if all space needs to be analysed, pick
5. Finally pick a folder where you’d like the recovered files to be stored.
In a nutshell, what we’ve done is imprinted all the low-level information from the block device in the Transformer to an external HDD, and used PhotoRec to scan through and pick up any file signatures it’s able to find.
Hope this guide has been a help.