1

I had an android phone that developed a fault in which it only persistently showed the boot logo. I sent it for Samsung for repair, who send it to a third-party company to be repaired. I was told that they are waiting for a part, for which they do not know when will be in stock and to avoid further delays would send me a replacement. That is good and all, but when I asked whether I could have my data, I was referred to the third-party company. They told me that because of certain protection laws they were not allowed to keep a backup of my data, even with my consent and that it has now been probably overwritten.

Before, sending it to repair I managed to get some file structure into three separate tar files using adb, which in the end turned out to be corrupted.

  • data.tar - 366,870,016 bytes
  • system.tar - 285,983,232 bytes
  • dbdata.tar - 6,245,888 bytes

I used the tar command to create the tar archive, while excluding directories that made the whole thing halt. After the tar was completed I received an error message/warning? (not sure what this was now). This was backed up to an internal SD card. I had access to this via the computer and thus was able to copy it. I am not sure when exactly the corruption happened, but I am guessing that the tar command didn't execute properly. Running strings, just brings up random characters.

tar tvf on data.tar & system.tar, shows nothing, on dbdata.jar:

tar: This does not look like a tar archive
tar: Skipping to next header
tar: Exiting with failure status due to previous errors

file tar on all of them says:

data.tar: data
dbdata.tar: data
system.tar: data

-

abc@xyz-virtual-machine:~/Downloads$ hd data.tar | head --lines=50
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
06588000  2e 20 20 20 20 20 20 20  20 20 20 10 00 ab b0 06  |.          .....|
06588010  07 3f 07 3f 00 00 b1 06  07 3f 2e 00 00 00 00 00  |.?.?.....?......|
06588020  2e 2e 20 20 20 20 20 20  20 20 20 10 00 ab b0 06  |..         .....|
06588030  07 3f 07 3f 00 00 b1 06  07 3f 00 00 00 00 00 00  |.?.?.....?......|
06588040  e5 45 00 75 00 72 00 6f  00 70 00 0f 00 91 65 00  |.E.u.r.o.p....e.|
06588050  00 00 ff ff ff ff ff ff  ff ff 00 00 ff ff ff ff  |................|
06588060  e5 55 52 4f 50 45 20 20  20 20 20 10 00 ae b0 06  |.UROPE     .....|
06588070  07 3f 07 3f 00 00 b1 06  07 3f 31 00 00 80 00 00  |.?.?.....?1.....|
06588080  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
06590000  2e 20 20 20 20 20 20 20  20 20 20 10 00 00 2b 80  |.          ...+.|
06590010  ce 3e ce 3e 00 00 2b 80  ce 3e 37 00 00 00 00 00  |.>.>..+..>7.....|
06590020  2e 2e 20 20 20 20 20 20  20 20 20 10 00 00 2b 80  |..         ...+.|
06590030  ce 3e ce 3e 00 00 2b 80  ce 3e 00 00 00 00 00 00  |.>.>..+..>......|
06590040  41 6d 00 65 00 74 00 61  00 00 00 0f 00 87 ff ff  |Am.e.t.a........|
06590050  ff ff ff ff ff ff ff ff  ff ff 00 00 ff ff ff ff  |................|
06590060  4d 45 54 41 20 20 20 20  20 20 20 10 00 00 20 18  |META       ... .|
06590070  38 40 38 40 00 00 27 18  38 40 42 00 00 00 00 00  |8@8@..'.8@B.....|
06590080  41 61 00 75 00 64 00 69  00 6f 00 0f 00 3d 00 00  |Aa.u.d.i.o...=..|
06590090  ff ff ff ff ff ff ff ff  ff ff 00 00 ff ff ff ff  |................|
065900a0  41 55 44 49 4f 20 20 20  20 20 20 10 00 00 30 80  |AUDIO      ...0.|
065900b0  ce 3e ce 3e 00 00 30 80  ce 3e 66 0b 00 00 00 00  |.>.>..0..>f.....|
065900c0  41 62 00 6f 00 6f 00 6b  00 6d 00 0f 00 91 61 00  |Ab.o.o.k.m....a.|
065900d0  72 00 6b 00 73 00 00 00  ff ff 00 00 ff ff ff ff  |r.k.s...........|
065900e0  42 4f 4f 4b 4d 41 7e 31  20 20 20 10 00 64 4a 19  |BOOKMA~1   ..dJ.|
065900f0  09 3f 09 3f 01 00 4a 19  09 3f de 01 00 00 00 00  |.?.?..J..?......|
06590100  41 61 00 75 00 64 00 69  00 6f 00 0f 00 e4 5f 00  |Aa.u.d.i.o...._.|
06590110  76 00 32 00 00 00 ff ff  ff ff 00 00 ff ff ff ff  |v.2.............|
06590120  41 55 44 49 4f 5f 56 32  20 20 20 10 00 64 a7 a6  |AUDIO_V2   ..d..|
06590130  b2 40 b2 40 02 00 a7 a6  b2 40 a9 28 00 00 00 00  |.@.@.....@.(....|
06590140  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
06598000  2e 20 20 20 20 20 20 20  20 20 20 10 00 00 2b 80  |.          ...+.|
06598010  ce 3e ce 3e 00 00 2b 80  ce 3e 42 00 00 00 00 00  |.>.>..+..>B.....|
06598020  2e 2e 20 20 20 20 20 20  20 20 20 10 00 00 2b 80  |..         ...+.|
06598030  ce 3e ce 3e 00 00 2b 80  ce 3e 37 00 00 00 00 00  |.>.>..+..>7.....|
06598040  e5 6d 00 65 00 74 00 61  00 2e 00 0f 00 6e 67 00  |.m.e.t.a.....ng.|
06598050  7a 00 00 00 ff ff ff ff  ff ff 00 00 ff ff ff ff  |z...............|
06598060  e5 45 54 41 20 20 20 20  47 5a 20 20 00 00 20 18  |.ETA    GZ  .. .|
06598070  38 40 38 40 02 00 20 18  38 40 11 41 a4 dd 20 01  |8@8@.. [email protected].. .|
06598080  e5 6d 00 65 00 74 00 61  00 2e 00 0f 00 d4 64 00  |.m.e.t.a......d.|
06598090  61 00 74 00 00 00 ff ff  ff ff 00 00 ff ff ff ff  |a.t.............|
065980a0  e5 45 54 41 20 20 20 20  44 41 54 20 00 00 27 18  |.ETA    DAT ..'.|
065980b0  38 40 38 40 02 00 27 18  38 40 eb 45 00 74 2c 03  |8@8@..'[email protected],.|
065980c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
065a0000  3c 3f 78 6d 6c 20 76 65  72 73 69 6f 6e 3d 22 31  |<?xml version="1|
065a0010  2e 30 22 3f 3e 3c 61 64  65 70 74 3a 64 65 76 69  |.0"?><adept:devi|

I have tried to use Advanced TAR Repair (http://archive.org/details/tucows_326605_Advanced_TAR_Repair), but without any success.

Is there any tool available which can scan each tar file carefully (it can be as slow as possible), and get as much file structure out as possible?

6
  • How did the tar files wind up corrupted? That may help in extracting data from them. And is the data there, e.g., if you run strings on them, do you see your data?
    – derobert
    Aug 28, 2012 at 16:13
  • @derobert I used the tar command to create the tar archive, while excluding directories that made the whole thing halt. After the tar was completed I received an error message/warning? (not sure what this was now). This was backed up to an internal SD card. I had access to this via the computer and thus was able to copy it. I am not sure when exactly the corruption happened, but I am guessing that the tar command didn't execute properly. Running strings, just brings up random characters. Aug 28, 2012 at 17:01
  • We don't have much info to go on here. What's the error you get when trying to run e.g. tar tvf data.tar? What does file tar say?
    – Jim Paris
    Aug 28, 2012 at 18:37
  • @JimParis tar tvf on data.tar & system.tar, shows nothing, on dbdata.jar: tar: This does not look like a tar archive tar: Skipping to next header tar: Exiting with failure status due to previous errors file tar on all of them says: data.tar: data dbdata.tar: data system.tar: data If needed I can send the files to one of you, but I do not want to put them here publicly since they could potentially contain personal data. Aug 28, 2012 at 18:45
  • Post the output of hd data.tar | head --lines=50 in your question, please
    – Jim Paris
    Aug 28, 2012 at 20:29

1 Answer 1

1

You won't be able to recover much.

According to your hd output, your data.tar file consists of 101 megabytes of zeros followed by some FAT32 directory entries. This is not a TAR file, rather it looks like a very corrupted / incomplete copy of a FAT filesystem. There is certainly not enough remaining structure to fix what's missing.

At this point, your best bet for getting the remaining fragments of what's left would be a tool like CGSecurity's PhotoRec, which searches through the image and attempts to identify files based on signatures.

4
  • Thank you, but how do I set one of the tar files as a virtual drive, because Photorec seems to only want to scan whole drives rather than a single file? Aug 29, 2012 at 16:03
  • @ProgrammerMan What OS are you on? On linux, look up the losetup command.
    – Random832
    Aug 29, 2012 at 17:31
  • If you're on Linux, just run photorec data.tar -- losetup is unnecessary.
    – Jim Paris
    Aug 29, 2012 at 17:37
  • @JimParis Well thank you very much for your effort and for letting me know about the PhotoRec tool. As you rightly predicted I could not extract any information unfortunately, the dbdata.tar file was the most important one to me since it contained my Contacts and Messages, but I only managed to extract a single mp4 file (not sure why its mp4, they should be SQLite databases), that is mostly composed of NUL bytes. I should learn my lesson and make backups, oh well. Aug 30, 2012 at 21:17

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .