0
Made an image of whole /dev/sda (with all partitions) via dd from adb shell from TWRP for further forensics and deleted file recovery. Can't mount disk image. Also tried to mount a small partition (sda19), same error.
mmls sda.dd
Cannot determine partition type
Some information about :
Disk /dev/loop9: 234.26 GiB, 251532365824 bytes, 491274152 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x00000000
Trying to mount:
sudo losetup /dev/loop9 sda.dd
sudo mount -o ro /dev/loop9 /mnt/temp1
mount: /mnt/temp1: wrong fs type, bad option, bad superblock on /dev/loop9, missing codepage or helper program, or other error.
mkfs.vfat -v sda.dd
mkfs.fat 4.1 (2017-01-24)
Auto-selecting FAT32 for large filesystem
sda.dd has 255 heads and 63 sectors per track,
hidden sectors 0x0000;
logical sector size is 512,
using 0xf8 media descriptor, with 491274152 sectors;
drive number 0x80;
filesystem has 2 32-bit FATs and 64 sectors per cluster.
FAT size is 59968 sectors, and provides 7674283 clusters.
There are 64 reserved sectors.
Volume ID is a0fea9a1, no volume label.
Trying to convert from sparse:
./simg2img
Invalid sparse file format at header magic
Failed to read sparse file
e2fsck
e2fsck -f /dev/loop9
e2fsck 1.45.4 (23-Sep-2019)
ext2fs_open2: Bad magic number in super-block
e2fsck: Superblock invalid, trying backup blocks...
e2fsck: Bad magic number in super-block while trying to open /dev/loop9
The superblock could not be read or does not describe a valid ext2/ext3/ext4
filesystem. If the device is valid and it really contains an ext2/ext3/ext4
filesystem (and not swap or ufs or something else), then the superblock
is corrupt, and you might try running e2fsck with an alternate superblock:
e2fsck -b 8193
or
e2fsck -b 32768
fsstat
fsstat sda.dd
FILE SYSTEM INFORMATION
--------------------------------------------
File System Type: FAT32
OEM Name: mkfs.fat
Volume ID: 0xa0fea9a1
Volume Label (Boot Sector): NO NAME
Volume Label (Root Directory):
File System Type Label: FAT32
Next Free Sector (FS Info): 120000
Free Sector Count (FS Info): 491154048
Sectors before file system: 0
File System Layout (in sectors)
Total Range: 0 - 491274151
* Reserved: 0 - 63
Boot Sector: 0
FS Info Sector: 1
Backup Boot Sector: 6
* FAT 0: 64 - 60031
* FAT 1: 60032 - 119999
* Data Area: 120000 - 491274151
Cluster Area: 120000 - 491274111
*** Root Directory: 120000 - 120063
** Non-clustered: 491274112 - 491274151
METADATA INFORMATION
--------------------------------------------
Range: 2 - 7858466438
Root Directory: 2
CONTENT INFORMATION
--------------------------------------------
Sector Size: 512
Cluster Size: 32768
Total Cluster Range: 2 - 7674284
FAT CONTENTS (in sectors)
--------------------------------------------
120000-120063 (64) -> EOF
Autopsy is detecting partition with fs type as raw but can't do anything with them.
Any suggestions? Thanks!
Were you trying to format the drive ? 'mkfs.vfat' should format the disk. – vssher – 2019-12-01T02:50:38.577
3
Possible duplicate of How can I mount a partition from dd-created image of a block device (e.g. HDD) under Linux?
– sawdust – 2019-12-01T02:58:28.330@sawdust I tried to make as mentioned in url that you provided. It creates empty disk with 252 GB volume. Command
mount
does not change anything afterlosetup
@vssher didn't know about it. Tried everything that I could found in internet. Should I make an image from adb again? – Vladmir – 2019-12-01T03:27:25.823That referenced post has several answers with several different methods. There are also additional links to several more posts mentioned in comments. You respond with one result for some unknown method. – sawdust – 2019-12-03T06:21:13.890