How to mount encrypted /data partition in recovery mode?

My current state:
Fairphone 3 with /e/OS installed is stuck in recovery mode, (I think) because there is not enough free memory space left. I need to erase some files from my Ubuntu 20.04 and I thought about using adb.

Problem:
I used disk encryption and now I don’t know how to access my data and where it is located. I can activate adb on my phone and access it from Ubuntu with adb shell command. For example if I run

adb shell

and then

FP3:/ # ls
acct        d              etc                    mnt                    plat_property_contexts     prop.default  sideload                  system_ext_property_contexts
apex        data           first_stage_ramdisk    odm                    postinstall                res           storage                   tmp
bin         data_mirror    init                   odm_file_contexts      proc                       root          sys                       vendor
bugreports  debug_ramdisk  init.recovery.qcom.rc  odm_property_contexts  product                    sbin          system                    vendor_file_contexts
cache       default.prop   linkerconfig           oem                    product_file_contexts      sdcard        system_ext                vendor_property_contexts
config      dev            metadata               plat_file_contexts     product_property_contexts  sepolicy      system_ext_file_contexts

When I then try to list the content of data/, storage or sdcard it shows an empty directory. How can I access my internal storage data?

1 Like

the e-recovery doesn’t package twrps openrecoveryscript - there you could issue twrp decrypt <pin> within adb… but can’t see the adb enable option in the twrp ui. The ui allows you to mount the userdata via UI though, right when you start it or later in its advanced menu.

fastboot boot twrp..img when you’re in fastboot

(I was curious how it works… code is at android_bootable_recovery/partitionmanager.cpp at 9d3ea68bc9e6687e94d2024d772736d80b33c4ef · omnirom/android_bootable_recovery · GitHub)

This sounds very reasonable thank you! But when I switch to fastboot mode I cannot find the device from Ubuntu 20.04 anymore :frowning:

Did you try to start Fastboot using sudo?

sudo: fastboot: command not found

Update: Sorry, here some more information. When I started fastboot mode on my phone I ran some comands:

anonymous@anonymous:~$ fastboot devices
no permissions (missing udev rules? user is in the plugdev group); see [http://developer.android.com/tools/device.html]	fastboot
anonymous@anonymous:~$ sudo fastboot
sudo: fastboot: command not found

Meanwhile I found the solution for the “no permissions” issue: https://lynxbee.com/solved-no-permissions-user-in-plugdev-group-are-your-udev-rules-wrong/#.Y2_-ukrMJH4

Sorry, don’t get exactly what you typed. Seems there are too many colons (:). Are you able to get a screenshot or photo of the shell output?

I think you need to first decrypt the device from /e/OS settings,
Then reboot to TWRP to take the backup of your data,

I am stuck in recovery mode. I cannot access settings.

I managed to run the fastboot boot ... command, but get an error message:

anonymous@anonymous:~$ fastboot boot ~/Downloads/twrp-3.7.0_9-0-FP3.img 
Sending 'boot.img' (31512 KB)                      OKAY [  0.854s]
Booting                                            FAILED (remote: 'unlock device to use this command')
fastboot: error: Command failed

I think I must unlock the bootloader. But if I remember correctly, this will erase all my data. Am I right? Or what shall I do?

2 Likes

Yes, exactly, that’s the problem. And when your device is locked you unfortunately can’t use the Fastboot command to install or not an image (and by unlocking it, it’d indeed remove all data).

1 Like

Dammit! Is there any way to access my encrypted data via adb? I just need to erase some files and then it would probably start normally… It would probably even be enough to erase some cache or apps or so…

One more question: Does it make sense to keep the bootloader unlocked next time I install /e/OS?

I’m very sorry, I’m not aware of any way… :frowning: Maybe others are…

Edit: cache might be deletable in recovery No, at least not in /e/ recovery.

Well, it’s more secure to leave the bootloader locked, but you have much more options if you keep it unlocked… (So everyone must decide for themselves…)

Thank you very much for your time! :slight_smile: Is it possible to remove some system files, like old OS versions or so? Not sure what parts are encrypted and what not. This is how the filesystem looks like:

FP3:/ # ls -l                                                                                       
total 1236
dr-xr-xr-x   4 root root           0 1970-01-02 04:54 acct
drwxr-xr-x   2 root root          40 1970-01-02 04:54 apex
lrwxrwxrwx   1 root root          11 1970-01-01 00:00 bin -> /system/bin
lrwxrwxrwx   1 root root          50 1970-01-01 00:00 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxr-xr-x   2 root root           0 1970-01-02 04:54 cache
drwxr-xr-x   5 root root           0 1970-01-01 00:00 config
lrwxrwxrwx   1 root root          17 1970-01-01 00:00 d -> /sys/kernel/debug
drwxr-xr-x   2 root root           0 1970-01-01 00:00 data
drwxr-xr-x   2 root root           0 1970-01-01 00:00 data_mirror
drwxr-xr-x   2 root root           0 1970-01-01 00:00 debug_ramdisk
lrwxrwxrwx   1 root root          12 1970-01-01 00:00 default.prop -> prop.default
drwxr-xr-x  11 root root        3580 1970-01-02 04:54 dev
lrwxrwxrwx   1 root root          11 1970-01-01 00:00 etc -> /system/etc
drwxr-xr-x   3 root root           0 1970-01-01 00:00 first_stage_ramdisk
lrwxrwxrwx   1 root root          16 1970-01-01 00:00 init -> /system/bin/init
-rwxr-x---   1 root root        3171 1970-01-01 00:00 init.recovery.qcom.rc
drwxr-xr-x   2 root root          60 1970-01-02 04:54 linkerconfig
drwxr-xr-x   2 root root           0 1970-01-01 00:00 metadata
drwxrwxr-x  10 root system       200 1970-01-02 04:54 mnt
drwxr-xr-x   2 root root           0 1970-01-01 00:00 odm
-rw-r--r--   1 root root           0 1970-01-01 00:00 odm_file_contexts
-rw-r--r--   1 root root           0 1970-01-01 00:00 odm_property_contexts
drwxr-xr-x   2 root root           0 1970-01-01 00:00 oem
-rw-r--r--   1 root root       36665 1970-01-01 00:00 plat_file_contexts
-rw-r--r--   1 root root       48232 1970-01-01 00:00 plat_property_contexts
drwxr-xr-x   2 root root           0 1970-01-01 00:00 postinstall
dr-xr-xr-x 355 root root           0 1970-01-01 00:00 proc
lrwxrwxrwx   1 root root          15 1970-01-01 00:00 product -> /system/product
-rw-r--r--   1 root root         107 1970-01-01 00:00 product_file_contexts
-rw-r--r--   1 root root        3369 1970-01-01 00:00 product_property_contexts
-rw-r--r--   1 root root       19971 1970-01-01 00:00 prop.default
drwxr-xr-x   3 root root           0 1970-01-01 00:00 res
drwx------   2 root root           0 2022-10-28 15:17 root
lrwxrwxrwx   1 root root          11 1970-01-02 04:54 sbin -> /system/bin
drwxr-xr-x   2 root root           0 1970-01-01 00:00 sdcard
-rw-r--r--   1 root root     1017092 1970-01-01 00:00 sepolicy
drwxr-xr-x   2 root root           0 1970-01-02 04:54 sideload
d---r-x---   2 root sdcard_r      40 1970-01-02 04:54 storage
dr-xr-xr-x  12 root root           0 1970-01-02 04:54 sys
drwxr-xr-x   5 root root           0 1970-01-01 00:00 system
lrwxrwxrwx   1 root root          18 1970-01-01 00:00 system_ext -> /system/system_ext
-rw-r--r--   1 root root        4382 1970-01-01 00:00 system_ext_file_contexts
-rw-r--r--   1 root root        7036 1970-01-01 00:00 system_ext_property_contexts
drwxrwxr-x   2 root shell        100 1970-01-02 04:56 tmp
drwxr-xr-x   2 root root           0 1970-01-01 00:00 vendor
-rw-r--r--   1 root root       80781 1970-01-01 00:00 vendor_file_contexts
-rw-r--r--   1 root root       16818 1970-01-01 00:00 vendor_property_contexts

Strange how little memory everything takes. The 64GB should be full…

If you feel desperate and you’re sure it’s a diskspace issue and you do have backups - you can delete directories via fbe when unencrypted too, you just don’t know what you’re deleting.

mount userdata via

mkdir -p /mnt/userdata
mount /dev/block/bootdevice/by-name/userdata /mnt/userdata/
du -cs /mnt/userdata/* | sort -n | tail -n10

and go rummaging?

an aside: mounting + chrooting /system and /lib partition (for shared lib dependencies) one can use vold for volume management - and maybe it has cli options to do the decryption for the ext4crypt scheme interactively. You can also push binaries (openrecoveryscript) via adb to the device… but really do that exploring only if you can stomach losing the userdata

3 Likes

I don’t understand exactly where to execute this. If I run your commands in a terminal from Ubuntu the following happens:

anonymous@anonymous:~$ sudo mount /dev/block/bootdevice/by-name/userdata /mnt/userdata/
mount: /mnt/userdata: special device /dev/block/bootdevice/by-name/userdata does not exist.
anonymous@anonymous:~$ ls /dev/block/
253:0  259:3  259:7  7:10  7:14  7:18  7:21  7:25  7:29  7:32  7:36  7:4  7:8
259:0  259:4  259:8  7:11  7:15  7:19  7:22  7:26  7:3   7:33  7:37  7:5  7:9
259:1  259:5  7:0    7:12  7:16  7:2   7:23  7:27  7:30  7:34  7:38  7:6  8:0
259:2  259:6  7:1    7:13  7:17  7:20  7:24  7:28  7:31  7:35  7:39  7:7
anonymous@anonymous:~$ adb shell
FP3:/ # mount /dev/block/bootdevice/by-name/userdata /mnt/userdata/
mount: '/dev/block/bootdevice/by-name/userdata'->'/mnt/userdata/': No such file or directory

I don’t know how to access the Ubuntu system when I am in adb shell and vice versa.

the commands are meant for the phone context, in the adb shell - not your host machine. You can only mount if the mountpoint exists (what’s the prior mkdir is for).

1 Like

Here you find only the size of thefiles in root directory. Most data will be within the directories.
You can check in cache and tmp directories if you find data there. This could be delete without grater risk.

1 Like

yep, as ff2u notes, you have to kind of know where it is safe do delete. It’s dangerous advice I’m giving if you dont know linux/android filesystem layouts

Okay thanks! I executed the commands:

anonymous@anonymous:~$ adb shell
FP3:/ # ls /dev/block/bootdevice/by-name/userdata                                                   
/dev/block/bootdevice/by-name/userdata
FP3:/ # mkdir -p /mnt/userdata
FP3:/ # mount /dev/block/bootdevice/by-name/userdata /mnt/userdata/
FP3:/ # du -cs /mnt/userdata/* | sort -n | tail -n10
5132	/mnt/userdata/system_ce
17080	/mnt/userdata/misc
17336	/mnt/userdata/vendor
23048	/mnt/userdata/system
34888	/mnt/userdata/user_de
118424	/mnt/userdata/tombstones
3021288	/mnt/userdata/app
14200420	/mnt/userdata/data
32829028	/mnt/userdata/media
50273856	total

Also the other directories:

FP3:/ # ls -l mnt/userdata/                                                                                                                                                                                total 468
drwx------   2 root     root      4096 1970-01-02 14:24 adb
drwx------   2 root     root      4096 1970-01-02 14:24 adbroot
drwxrwxr-x   2 system   system    4096 2022-11-11 15:41 anr
drwxr-xr-x   6 root     system    4096 1970-04-28 05:40 apex
drwxrwx--x  56 system   system   12288 2022-11-11 16:13 app
drwx------   2 root     root      4096 1970-01-02 14:24 app-asec
drwxrwx--x   2 system   system    4096 1970-01-02 14:24 app-ephemeral
drwxrwx--x   2 system   system    4096 1970-01-02 14:24 app-lib
drwxrwx--x   2 system   system    4096 1970-01-02 14:24 app-private
drwxr-x---   2 system   system    4096 1970-01-02 14:24 app-staging
drwx------   5 system   system    4096 2022-11-13 13:22 backup
drwxr-xr-x   2 shell    shell     4096 1970-01-02 14:24 bootchart
drwxrwx---   5 system   cache     4096 1970-01-02 14:24 cache
drwxrwx--x   4 root     root      4096 1970-03-22 04:41 dalvik-cache
drwxrwx--x 297 system   system   20480 2022-11-11 16:06 data
drwxrwx--x   2 system   system    4096 1970-04-28 05:41 dpm
drwxrwx---   3 drm      drm       4096 2020-12-15 00:47 drm
drwxrwx--x   2 system   system    4096 1970-01-02 14:24 fota
drwx------   5 root     root      4096 1970-04-28 05:41 gsi
drwxrwx---   2 system   wifi      4096 1970-01-02 14:24 hostapd
drwxrwx--x   2 system   system    4096 1970-04-28 05:40 incremental
drwxrwx---   2 system   cache     4096 2022-11-05 16:04 lineageos_updates
drwxr-x--x   4 root     root      4096 1970-01-02 14:24 local
drwxrwx---   2 root     root     16384 1970-01-02 14:24 lost+found
drwxrwx---   3 media_rw media_rw  4096 2022-11-13 13:22 media
drwxrwx---   2 mediadrm mediadrm  4096 1970-01-02 14:24 mediadrm
drwxrwx--t  55 system   misc      4096 2022-11-07 12:22 misc
drwxrwx--t   3 system   misc      4096 2020-12-15 00:47 misc_ce
drwxrwx--t   3 system   misc      4096 1970-01-02 14:24 misc_de
drwxrwx---   3 nfc      nfc       4096 2020-12-15 00:47 nfc
drwxrwx--x   2 root     root      4096 1970-03-22 04:41 ota
drwxrwx---   2 system   cache     4096 1970-01-02 14:24 ota_package
drwx------   2 system   system    4096 2022-11-13 13:22 per_boot
drwxrwxr-x   2 system   system    4096 1970-01-02 14:24 preloads
drwx------   2 root     root      4096 2022-11-13 13:22 property
drwxrwx--x   2 system   system   20480 2022-11-07 12:22 resource-cache
drwx------   2 system   system    4096 1970-01-02 14:24 rollback
drwx------   2 system   system    4096 1970-01-02 14:24 rollback-observer
drwxrwxr-x   2 system   system    4096 1970-01-02 14:24 server_configurable_flags
drwxr-xr-x   2 system   system    4096 1970-01-02 14:24 shared
drwx------   2 system   system    4096 1970-01-02 14:24 ss
drwxr-x---   3 root     shell     4096 1970-01-02 14:24 ssh
drwxrwxr-x  26 system   system    4096 2022-11-13 13:22 system
drwxrwx---   3 system   system    4096 2020-12-15 00:47 system_ce
drwxrwx---   3 system   system    4096 2022-11-13 13:22 system_de
drwxrwx--x   2 system   system    4096 2022-10-23 13:09 tombstones
drwx------   3 root     root      4096 1970-01-02 14:24 unencrypted
drwx--x--x   3 system   system    4096 1970-04-28 05:40 user
drwx--x--x   3 system   system    4096 1970-01-02 14:24 user_de
drwxrwx--x  40 root     root      4096 1970-04-28 05:41 vendor
drwxrwx--x   3 root     root      4096 2020-12-15 00:47 vendor_ce
drwxrwx--x   3 root     root      4096 1970-01-02 14:24 vendor_de

and the question is now: Is there anything that I can remove more or less safely? I hoped to be able to remove data from certain apps. But I cannot find where the data belongs to.

you go inside media/ and drill yourself down the dirextories until you find some juicy big files, videos presumably (you wont be able to tell from outside though). It’s russian roulette and I wont take responsibility :slight_smile:

2 Likes