Android - Is there a way to get a disk image of the user storage space on modern Android devices?
After doing some more research, I think I've found a partial solution here:
First, you need to get ADB set up on your computer. In Linux it's pretty easy. Something like running
# apt-get install android-tools-adbor downloading and extracting a directory.
Find your partitions. Run something like:
cat /proc/partitionsThere are other options in the link for how to find and identify all the partitions.
Copy the data The dd tool should be available. You can run something like
dd if=/dev/block/mmcblk0p9 of=/sdcard/image.img
Unfortunately, I have two problems with this. The first is that the permissions on partition devices might require root access. The second is that the Kindle Fire HDX and many other modern devices that don't have "USB Mass Storage" also don't use SD cards. So there is no easy location to write the image you want that isn't already used for something else on the device.
I'm trying to find a way to mount network devices or transfer data over USB between the device and computer (adb push and adb pull won't do what's needed as far as I can tell). I'll update this if I can find a good solution. Otherwise I'll ask some other questions about it.
Edit: This page has a great description along the lines of what I have above: http://www.df.lth.se/~jokke/androidfilerecovery/
As noted below, root is necessary, but there are usually lots of ways to get that easily. Unfortunately, I was working with the Fire HDX 8.9. Halfway through my copying data to an image file, the thing auto downloads an update to 4.1.1. Next thing I know, root access disappears and I don't think there's an exploit out for it yet. I probably lost any recoverable data after the update was written to the internal storage anyway. I'm so frustrated with Amazon lately...
Joshua pretty much answered the question. However, Izzy gave extra insight to tackle them odd/rare variations of the same problem.
I would like to contribute (my first contribution post in over 10 years) for those who would stumble into the very same scenario as I did. Anyways, 24 hours later, with persistent and determination, the following command will shed some light (assuming you've intermediate/advanced skills already).
Btw, I won't be explaining it, as the command itself is pretty obvious.
adb shell "dd if=/dev/block/mmcblk0p37 of=/dev/pts/0" > part37-img-dump.dd
These are the tools I used to get the job done.
C:\HTCOneRoot\ |--\adb.exe (version 1.0.31 21/05/2013, latest was buggy) |--\fastboot.exe (version fc2a139a55f5-android 24/04/2016) |--\AdbWinApi.dll |--\AdbWinUSBApi.dll |--\part37-img-dump.dd (output from the 'adb' command)
- dd will output stats to stdout after completion (BusyBox related)
- find a tool to trim the unwanted offsets at the EOF (not a must to do)
- mount the image using the preferred data recovery software or whatever
- /dev/pts/0 should work straight up, but if you happen to be running multiple adb shell command from multiple console/terminal, then be careful of the dev pointer ref number as it will be different. By using the following command, you can simply figure out which one: pts:0, pts:1, ...
adb shell "ps -l"