2

I have a backup file, generated by an android phone. However, I don't know the file type or how to extract the contents without the original software. I've tried to search for common file headers using hexdump, but as I'm new to this topic, I have no idea on how to continue.

I know the following things: - The file has to be some sort of container or compressed archive - The file is split up into multiple parts (userdata_xxxx.backup, userdata_xxxx.backup1, ...) - The file starts with the following content:

00000000  53 3a 79 0e 63 9a 67 f3  a2 22 ff 40 64 51 5d 5a  |S:y.c.g..".@dQ]Z|
00000010  61 18 d0 b8 7b 5b 6c 13  c7 72 17 60 00 ee ed e1  |a...{[l..r.`....|
00000020  51 d0 97 59 a6 40 aa d9  b6 c3 09 cf aa 8a 79 ff  |Q..Y.@........y.|
00000030  5f 7c dc d0 09 7e 11 56  e3 58 38 c7 03 a0 67 ea  |_|...~.V.X8...g.|
00000040  f5 b3 04 fa 65 fc 85 ae  c0 db eb 38 00 58 53 af  |....e......8.XS.|
00000050  8a 8d 1d c9 65 eb 1e 1a  2c 19 c7 62 62 71 8b c9  |....e...,..bbq..|
00000060  ac cc 0e c5 6f bd 92 5d  69 9e 88 28 ef af d9 54  |....o..]i..(...T|
00000070  21 33 59 60 5f 77 e7 0e  8b 70 03 f1 b3 e3 5b ce  |!3Y`_w...p....[.|
00000080  57 ff b5 13 cb 3c f1 84  4a 5f 25 e7 80 c0 b9 a5  |W....;.-.._....p&.|
00000100  1e 7e 7d 41 37 df a0 55  0e 7a f3 64 74 e2 6b ca  |.~}A7..U.z.dt.k.|
00000110  4f 4f 9f 32 11 cb d3 3d  6c 29 72 55 72 08 66 a5  |OO.2...=l)rUr.f.|
00000120  2c 67 33 74 6a 82 88 01  90 ce 63 54 83 f3 63 5e  |,g3tj.....cT..c^|
00000130  8e 4e 53 4e 8e bd ec 57  4f ed 69 4f f0 92 9e ef  |.NSN...WO.iO....|
00000140  9d 60 24 57 a0 32 ed 0a  2e f5 00 cb 4e e3 7a 69  |.`$W.2......N.zi|
00000150  7a cc b7 54 51 24 00 6b  94 df 86 78 cd a0 50 db  |z..TQ$.k...x..P.|
00000160  bf 9d fa 9e 91 91 64 f8  9c 89 ed 28 0b 65 fd d1  |......d....(.e..|
00000170  ef f3 dc f8 24 61 c6 08  70 d9 31 04 6f 56 cc 81  |....$a..p.1.oV..|
00000180  2b 8b da 4a c2 86 98 70  c0 12 3d d5 8a 64 f6 45  |+..J...p..=..d.E|
00000190  17 14 2c 20 9f 4c 96 4e  56 8c 19 5e fa c4 af 19  |.., .L.NV..^....|
000001a0  22 20 48 4c e4 9d 7f d3  e2 63 ec 12 2b a1 7a 76  |" HL.....c..+.zv|
000001b0  cb 97 28 c1 49 62 d8 84  34 33 90 2e 34 35 e5 0c  |..(.Ib..43..45..|
000001c0  84 6b 56 95 46 6d c2 77  12 d4 c5 58 19 e9 ce 26  |.kV.Fm.w...X...&|
000001d0  6b e5 88 1c b7 d0 40 f8  dd 50 ab c6 00 b5 c5 12  |k.....@..P......|
000001e0  fe d2 8d 62 d6 06 4e e2  50 21 94 1c c2 44 b6 fa  |...b..N.P!...D..|
000001f0  b9 51 91 5b 00 fa 2d 78  10 40 f4 66 c5 a2 85 3d  |.Q.[..-x.@.f...=|
00000200  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000600  90 d2 1a 00 80 3f 6b 00  00 10 00 00 12 68 09 00  |.....?k......h..|
00000610  f9 72 19 00 00 00 00 00  02 00 00 00 02 00 00 00  |.r..............|
00000620  00 80 00 00 00 80 00 00  f0 1f 00 00 54 52 7b 59  |............TR{Y|
00000630  55 52 7b 59 4a 00 ff ff  53 ef 01 00 02 00 00 00  |UR{YJ...S.......|
00000640  71 a8 41 59 00 00 00 00  00 00 00 00 01 00 00 00  |q.AY............|
00000650  1a 27 00 00 0b 00 00 00  00 01 00 00 1c 00 00 00  |.'..............|
00000660  46 00 00 00 13 00 00 00  57 f8 f4 bc ab f4 65 5f  |F.......W.....e_|
00000670  bf 67 94 6f c0 f9 f2 5b  00 00 00 00 00 00 00 00  |.g.o...[........|
00000680  00 00 00 00 00 00 00 00  2f 64 61 74 61 00 00 00  |......../data...| //data is a directory that the file must contain
00000690  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000006c0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 04  |................|
000006d0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000006e0  08 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000006f0  00 00 00 00 00 00 00 00  00 00 00 00 02 01 20 00  |.............. .|
00000700  00 00 00 00 00 00 00 00  00 00 00 00 0a f3 02 00  |................|
00000710  03 00 00 00 00 00 00 00  00 00 00 00 fe 7d 00 00  |.............}..|
00000720  01 02 01 00 fe 7d 00 00  02 02 00 00 01 02 6b 00  |.....}........k.|
00000730  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00000750  00 00 00 00 00 00 00 00  00 00 00 00 1c 00 1c 00  |................|
...
  • there have to be images in the file, jpeg images look like this:
...
0060a7e0  25 39 37 2b 46 ca e9 ce  56 4e 6e 31 b2 b5 94 db  |%97+F...VNn1....|
0060a7f0  77 4d b8 ca a3 ff d9 00  00 00 00 00 00 00 00 00  |wM..............| //JPEG footer, first image ends here
0060a800  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0060b000  c8 d7 79 0a 69 c7 60 00  23 10 00 00 07 80 00 06  |..y.i.`.#.......|
0060b010  05 07 03 40 1f 40 1f 00  04 80 00 ff ff ff 00 00  |...@.@..........|
0060b020  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0060c000  ff d8 ff e0 00 10 4a 46  49 46 00 01 01 00 00 01  |......JFIF......| //JPEG header, next image starts
0060c010  00 01 00 00 ff db 00 43  00 01 01 01 01 01 01 01  |.......C........|
0060c020  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
*
0060c050  01 01 01 01 01 01 01 01  01 ff db 00 43 01 01 01  |............C...|
0060c060  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
*
0060c090  01 01 01 01 01 01 01 01  01 01 01 01 01 01 ff c0  |................|
0060c0a0  00 11 08 00 60 00 60 03  01 22 00 02 11 01 03 11  |....`.`.."......|
0060c0b0  01 ff c4 00 1f 00 00 01  05 01 01 01 01 01 01 00  |................|
0060c0c0  00 00 00 00 00 00 00 01  02 03 04 05 06 07 08 09  |................|
0060c0d0  0a 0b ff c4 00 b5 10 00  02 01 03 03 02 04 03 05  |................|
0060c0e0  05 04 04 00 00 01 7d 01  02 03 00 04 11 05 12 21  |......}........!|
0060c0f0  31 41 06 13 51 61 07 22  71 14 32 81 91 a1 08 23  |1A..Qa."q.2....#|
0060c100  42 b1 c1 15 52 d1 f0 24  33 62 72 82 09 0a 16 17  |B...R..$3br.....|
0060c110  18 19 1a 25 26 27 28 29  2a 34 35 36 37 38 39 3a  |...%&'()*456789:|
0060c120  43 44 45 46 47 48 49 4a  53 54 55 56 57 58 59 5a  |CDEFGHIJSTUVWXYZ|
0060c130  63 64 65 66 67 68 69 6a  73 74 75 76 77 78 79 7a  |cdefghijstuvwxyz|
...
  • text files seem to be stored uncompressed, the content can be read
...
00677230  69 63 2c 20 49 6e 63 2e  2c 20 53 6f 6e 79 2f 41  |ic, Inc., Sony/A|
00677240  54 56 20 4d 75 73 69 63  20 50 75 62 6c 69 73 68  |TV Music Publish|
00677250  69 6e 67 20 4c 4c 43 22  7d 2c 22 68 69 64 65 68  |ing LLC"},"hideh|
00677260  65 61 64 65 72 22 3a 66  61 6c 73 65 7d 2c 22 62  |eader":false},"b|
00677270  65 61 63 6f 6e 64 61 74  61 22 3a 7b 22 70 72 6f  |eacondata":{"pro|
00677280  76 69 64 65 72 6e 61 6d  65 22 3a 22 4c 79 72 69  |vidername":"Lyri|
00677290  63 73 22 7d 7d 2c 7b 22  69 64 22 3a 22 66 61 63  |cs"}},{"id":"fac|
006772a0  65 62 6f 6f 6b 22 2c 22  74 79 70 65 22 3a 22 73  |ebook","type":"s|
006772b0  70 6f 6e 73 6f 72 65 64  22 2c 22 70 72 6f 76 69  |ponsored","provi|
006772c0  64 65 72 6e 61 6d 65 22  3a 22 66 61 63 65 62 6f  |dername":"facebo|
006772d0  6f 6b 22 2c 22 73 69 74  65 6b 65 79 22 3a 22 74  |ok","sitekey":"t|
...
  • all the files start in a similar way, at least the first few chars are the same
//file 2
00000000  53 3a 79 0e 63 9a 67 f3  a2 22 ff 40 3a 53 5f 0b  |S:y.c.g..".@:S_.|
00000010  a0 3c e4 5b b9 38 e2 70  97 7d 7b 6b 99 2f 93 eb  |.'.0T.......|
00000090  bc 0f 24 1d 3d d7 42 91  56 17 c6 c5 09 ad 6a 2f  |..$.=.B.V.....j/|
000000a0  3f cd 0d ae ab cc 89 2f  7d 92 de 91 7b dc 8c 60  |?....../}...{..`|
000000b0  48 f5 74 17 3a c5 57 8d  dc c8 d0 83 71 5a c5 8b  |H.t.:.W.....qZ..|
000000c0  b8 ea ae b5 49 16 77 2a  d0 6b 97 ca 8f 3f 28 77  |....I.w*.k...?(w|
000000d0  e3 5a ef 8c 71 df 0e 9e  6b 77 d6 1c 79 6d e9 22  |.Z..q...kw..ym."|
000000e0  16 62 f5 2e 05 21 16 e3  1b 39 a1 1f f5 55 59 72  |.b...!...9...UYr|
000000f0  a4 e5 87 50 d5 b2 f4 0c  9b 4b 19 7a c4 b9 b6 70  |...P.....K.z...p|
00000100  f7 44 54 f2 27 03 25 e1  95 80 b2 e3 ff dd 3e 13  |.DT.'.%.......>.|
00000110  54 de 14 fa bb f3 07 b7  db 99 0c 7b 0e 56 7e 72  |T..........{.V~r|
00000120  02 ef de fd b2 48 b3 72  39 e5 39 08 01 74 85 37  |.....H.r9.9..t.7|
00000130  9c 6e 56 62 0d 15 8c 22  c3 ad 61 a5 ba 87 f7 0d  |.nVb..."..a.....|
00000140  5c 8e 54 84 0f b9 9e 9c  36 ea 41 db e8 c3 cb e7  |\.T.....6.A.....|
00000150  72 1d 94 75 e9 d8 13 48  fa eb fd 61 cb 2f d3 64  |r..u...H...a./.d|
00000160  55 d0 23 d7 c0 64 5d 1c  a2 55 e7 31 be 2b f3 76  |U.#..d]..U.1.+.v|
00000170  9a e2 c1 db b4 22 ce 40  52 12 00 21 8b c4 9e cb  |.....".@R..!....|
00000180  e2 26 82 fd b2 a0 b6 3b  19 1f 37 d0 25 8a 62 1a  |.&.....;..7.%.b.|
00000190  b2 ab 95 12 e7 f9 4b 49  a6 45 07 b0 09 c0 7b 9b  |......KI.E....{.|
000001a0  25 1e 56 de 2b 94 2e eb  e3 04 47 09 c7 18 06 10  |%.V.+.....G.....|
000001b0  50 30 4c e2 40 a8 0d ae  1a 6e a6 33 e8 d3 f6 e4  |P0L.@....n.3....|
000001c0  63 e5 8d bd 0a 2f de ce  93 1c 0a a5 85 a9 6d 2c  |c..../........m,|
000001d0  16 d9 38 f0 86 cf 08 b9  56 a6 4a 6c b6 dd d4 24  |..8.....V.Jl...$|
000001e0  03 c6 dc 61 3c 7f df 6c  b9 6d ce 59 35 16 5d 8d  |...afB|
00000320  25 7b 61 71 92 26 b8 88  de 47 12 5a b6 25 aa 52  |%{aq.&...G.Z.%.R|
00000330  94 77 bf 96 7f 37 f7 ef  e5 31 7b 7c 7e ea f8 dc  |.w...7...1{|~...|
00000340  df 6d 8b d1 c6 11 b0 30  a2 00 ae ea 4a 0a 0f 38  |.m.....0....J..8|
00000350  e6 eb f9 e9 a5 00 8e 43  65 1a fc b5 a0 2f 53 89  |.......Ce..../S.|
00000360  2a e0 51 10 75 5a 0b 39  14 11 d9 00 b8 30 92 96  |*.Q.uZ.9.....0..|

[UPDATE] - sometimes, filenames can be read before the file data

...
0060ea30  d7 34 52 94 39 a5 cc a4  9f ff d9 00 00 00 00 00  |.4R.9...........| //JPEG footer
0060ea40  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
0060f200  2f 65 74 63 2f 2e 74 70  2f 74 68 65 72 6d 61 6c  |/etc/.tp/thermal| //file path
0060f210  2e 63 6f 6e 66 0a 30 00  00 00 00 00 00 00 00 00  |.conf.0.........|
0060f220  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
00610200  ff d8 ff e0 00 10 4a 46  49 46 00 01 01 00 00 01  |......JFIF......| //next JPEG starts
00610210  00 01 00 00 ff db 00 43  00 01 01 01 01 01 01 01  |.......C........|
00610220  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
*
00610250  01 01 01 01 01 01 01 01  01 ff db 00 43 01 01 01  |............C...|
00610260  01 01 01 01 01 01 01 01  01 01 01 01 01 01 01 01  |................|
*
00610290  01 01 01 01 01 01 01 01  01 01 01 01 01 01 ff c0  |................|
006102a0  00 11 08 00 60 00 60 03  01 22 00 02 11 01 03 11  |....`.`.."......|
006102b0  01 ff c4 00 1f 00 00 01  05 01 01 01 01 01 01 00  |................|
006102c0  00 00 00 00 00 00 00 01  02 03 04 05 06 07 08 09  |................|
006102d0  0a 0b ff c4 00 b5 10 00  02 01 03 03 02 04 03 05  |................|
006102e0  05 04 04 00 00 01 7d 01  02 03 00 04 11 05 12 21  |......}........!|
006102f0  31 41 06 13 51 61 07 22  71 14 32 81 91 a1 08 23  |1A..Qa."q.2....#|
00610300  42 b1 c1 15 52 d1 f0 24  33 62 72 82 09 0a 16 17  |B...R..$3br.....|
00610310  18 19 1a 25 26 27 28 29  2a 34 35 36 37 38 39 3a  |...%&'()*456789:|
00610320  43 44 45 46 47 48 49 4a  53 54 55 56 57 58 59 5a  |CDEFGHIJSTUVWXYZ|
00610330  63 64 65 66 67 68 69 6a  73 74 75 76 77 78 79 7a  |cdefghijstuvwxyz|
...

If you need more information or more snippets, please just let me know. For privacy reasons I don't want to post the entire file, it would also be too big for an upload. I'm interested in your ideas on how to go on in analyzing the file or unpacking it.

UPDATE 2: What I've tried so far:

  • appended all files together, at first with 512 bytes cutted of the first file, after that with 512 bytes cutted of all files. Results of both tries:

    mount -t ext4 combined.img /mnt/ext4_image/
    Works (no output from command, file is mounted), but directory is empty. Tried the same on windows with an application that supports ext4, shows an empty directory named "data".

  • used simg2img:

simg2img combined.img combined.raw

Output:

Invalid sparse file format at header magi
Failed to read sparse file
  • unpacking with tar/gunzip: File doesn't seem to be a tar/zip file, tried that with and without the offset of 512 bytes.
Improve this question
5
  • how exactly did you generate the backup? did you use a specific app?
    – Igor Skochinsky ♦
    Sep 28, 2017 at 7:51
  • the backup was generated using the stock recovery and the option "backup data to sd card" (or something similar)
    – DarkQuäääse
    Sep 28, 2017 at 15:05
  • it seems the magic of the sparse image is 0xed26ff3a (or 3A F 26 ED in little endian). Do you have such a byte sequence in any of the files?
    – Igor Skochinsky ♦
    Oct 4, 2017 at 18:21
  • No, I didn't find this exact sequenze, at least not in a notable position near the beginning of any of the 14 files.
    – DarkQuäääse
    Oct 5, 2017 at 10:25
  • If mounting succeeded then sounds like it's a non-sparse ext4 image but somehow modified so that the files don't show up... for now I can only suggest looking up the format spec and try to match it against your files.
    – Igor Skochinsky ♦
    Oct 5, 2017 at 13:16

1 Answer 1

Reset to default
1

According to this post on Android.SE, the stock backup is either a .tar.gz or an simg (sparse ext4 image). So, the following is supposed to work:

  1. Merge the multiple .backupN files into one
  2. Cut off the first 512 bytes (it probably contains some non-critical metadata)
  3. try unpacking with tar/gzip. If it doesn't work, go to next step.
  4. run simg2img on it
  5. mount as an ext4fs image or use an extractor program.
Improve this answer
4
  • Thanks for your answer. However, I've already found these steps before asking and tried them out - with no luck. Extracting with tar doesn't work, and simg2img gives me a Invalid sparse file format at header magi Failed to read sparse file.
    – DarkQuäääse
    Oct 1, 2017 at 9:41
  • 1
    well, would have been nice if you mentioned that in your question... please update it with the details of what exactly you did and the error messages.
    – Igor Skochinsky ♦
    Oct 1, 2017 at 9:44
  • if it's really just standard sparse ext4 image, i'm not sure this involves any RE as such...
    – Igor Skochinsky ♦
    Oct 1, 2017 at 9:47
  • I've updated the question with details about what i've already tried.
    – DarkQuäääse
    Oct 3, 2017 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.