[HELP!] Recovering NANDroid backup files from raw clone of formatted internal storage

I had been flashing a rom onto my phone (RR 8.0) and customarily had taken a TWRP nandroid backup of the existing rom (RR 7.1.2). Then when I went to wipe data, cache, system, I had accidentally checked the internal storage too and wiped it as a result. At this point all I could do was flash the rom, then magisk root and busybox, then I cloned internal storage (which I identified using cat /proc/partitions to be block sda18) using ADB and Cygwin (with the netcat package) thus:


TERM-1 ------ adb forward tcp:5555 tcp:5555 adb shell su /system/xbin/busybox nc -l -p 5555 -e /system/xbin/busybox dd if=/dev/block/sda18

TERM-2 ------ adb forward tcp:5555 tcp:5555 nc 5555 | pv -i 0.5 > sda18.dd

Couple hours later I end up with ~23.5 GB of raw partition dump (all 24,649,728 blocks of sda18 copied, I checked). Now most file recovery software (Testdisk, PhotoRec, products) I've tried seem to check for file signatures/extensions, naturally TWRP's backups aren't among them.

TL;DR: All I need at this point is one file in particular: data.ext4.win?? – the backup of the data partition, hope I got that extension right – by a data recovery software that can hunt those very few backup files from a cloned internal storage image.

(No, partition recovery is no good.)

Clearly these files are still out there among the sectors because all that I'd done to internal storage was a format. Having come so far I find it hard to believe there isn't software that can find TWRP backup files due to its variable filetype extension. I would assume the file signature is that of TAR files, but I'm not sure.

Recovering these backups is important to me because trying to recover files from the data partition, for example, ends up returning nondescript, unlabeled data by the thousands, no way to know which file is which (looking at you, Photorec). Restoring a backup would return the data partition exactly the way it was before it was wiped out. The rest of what used to be the contents of my internal storage are not important to me. I have over 2,000 contacts that were not backed up to any online or offline service, which most definitely resides in that backup file. Please help me with some legitimate solution or suggestion rather than to say it won't be possible – no reason to believe so when I have the cloned image of the internal storage – at the very least a data recovery software that can help me get those deleted backups out ASAP (my business relies critically on those contacts and chat app histories). Time is of the essence here, I humbly request the community's help urgently.

PS I realize this question has more to do with forensic data recovery but I'll still give it a shot in here. Hope this post isn't too vague in stating what I want done. I'm sure this would massively help others in the future too, given how common such an occurrence is.

Show Accepted Answer

Guest Quick Reply (No URL, BBcode or HTML)

Last post by matteo22
1 hour ago
Last post by ecrooks
2 hours ago
Last post by liliana10
3 hours ago
Last post by bauch.river
17 minutes ago
Last post by udaniel
1 hour ago
Last post by kaley49
2 hours ago
Last post by towne.ebba
2 hours ago
Last post by arnulfo85
1 hour ago
Last post by west.jayme
1 hour ago
Last post by nschulist
3 hours ago