0

I have userdata backup file (Userdata.bin) of oneplus 7pro. I want to extract photos and videos from this. when i used the command "binwalk userdata.bin" it shows

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
20005546      0x13142AA       Uncompressed Adobe Flash SWF file, Version 50, File size (header included) 492522729
29002559      0x1BA8B3F       gzip compressed data, ASCII, has header CRC, has 19451 bytes of extra data, has comment, last modified: 2020-12-09 15:06:36
151223348     0x9037C34       LZMA compressed data, properties: 0x5D, dictionary size: -1091371008 bytes, uncompressed size: 2629435300301145041 bytes
154662425     0x937F619       Uncompressed Adobe Flash SWF file, Version 84, File size (header included) 692587800
157747503     0x967092F       MySQL MISAM compressed data file Version 10
158766212     0x9769484       MySQL MISAM index file Version 1
190759179     0xB5EC10B       LZMA compressed data, properties: 0x5D, dictionary size: -1956052992 bytes, uncompressed size: 1941629611387946799 bytes
203769284     0xC2545C4       Uncompressed Adobe Flash SWF file, Version 59, File size (header included) 1680641900
207505633     0xC5E48E1       Uncompressed Adobe Flash SWF file, Version 48, File size (header included) 1781182940
226976766     0xD8763FE       LZMA compressed data, properties: 0x5D, dictionary size: 603127808 bytes, uncompressed size: 2626171271486306996 bytes
237346339     0xE259E23       LZMA compressed data, properties: 0x5D, dictionary size: -1186856960 bytes, uncompressed size: 5193331955517265233 bytes
243780541     0xE87CBBD       Qualcomm device tree container, version: 1230904524, DTB entries: 2855478585
253201947     0xF178E1B       Uncompressed Adobe Flash SWF file, Version 67, File size (header included) 2522853576
267473318     0xFF151A6       Uncompressed Adobe Flash SWF file, Version 19, File size (header included) 2472055891
291443759     0x115F142F      Uncompressed Adobe Flash SWF file, Version 1, File size (header included) 1874015997
292915366     0x117588A6      Uncompressed Adobe Flash SWF file, Version 11, File size (header included) 3162630366
308191417     0x125EA0B9      Cisco IOS experimental microcode, for ""
319599114     0x130CB20A      Uncompressed Adobe Flash SWF file, Version 15, File size (header included) 3526619997
326306949     0x13730C85      LZMA compressed data, properties: 0x5D, dictionary size: -2117468160 bytes, uncompressed size: 163227338804047963 bytes
346510442     0x14A7546A      LZMA compressed data, properties: 0x5D, dictionary size: -851968000 bytes, uncompressed size: 2692117331713841249 bytes
350481505     0x14E3EC61      LZMA compressed data, properties: 0x5D, dictionary size: -1255473152 bytes, uncompressed size: 2851849894619330354 bytes
352437944     0x1501C6B8      LZMA compressed data, properties: 0x5D, dictionary size: -747634688 bytes, uncompressed size: 5173880095999022411 bytes
361964804     0x15932504      Uncompressed Adobe Flash SWF file, Version 32, File size (header included) 2191480467
392279284     0x1761B4F4      LZMA compressed data, properties: 0x5D, dictionary size: 753664000 bytes, uncompressed size: 5960100682697462886 bytes
402652160     0x17FFFC00      Linux EXT filesystem, blocks count: 59463283, image size: 60890401792, rev 1.0, ext4 filesystem data, UUID=9c665de0-9d83-42e0-bd1d-34377c027c02, volume name "data"
61339173326   0xE481981CE     Uncompressed Adobe Flash SWF file, Version 47, File size (header included) 2210144418
61566954532   0xE55AD2C24     Uncompressed Adobe Flash SWF file, Version 74, File size (header included) 4195364806
61684479138   0xE5CAE74A2     LZMA compressed data, properties: 0x5D, dictionary size: 1182859264 bytes, uncompressed size: 2804843589326703007 bytes
61968602376   0xE6D9DD508     Uncompressed Adobe Flash SWF file, Version 116, File size (header included) 3412781761
61975025774   0xE6DFFD86E     Uncompressed Adobe Flash SWF file, Version 68, File size (header included) 4194399919
61989984097   0xE6EE41761     LZMA compressed data, properties: 0x5D, dictionary size: -1768292352 bytes, uncompressed size: 6412360571714312808 bytes
62127752762   0xE771A463A     Uncompressed Adobe Flash SWF file, Version 59, File size (header included) 1211029814
62128958366   0xE772CAB9E     LZMA compressed data, properties: 0x5D, dictionary size: -732168192 bytes, uncompressed size: 8252619256980203060 bytes
62157149472   0xE78DAD520     Uncompressed Adobe Flash SWF file, Version 63, File size (header included) 196400005
62243597604   0xE7E01ED24     LZMA compressed data, properties: 0x5D, dictionary size: -1077280768 bytes, uncompressed size: 3052131975490100006 bytes
62291518645   0xE80DD24B5     Uncompressed Adobe Flash SWF file, Version 3, File size (header included) 3875421330
62297677360   0xE813B1E30     Uncompressed Adobe Flash SWF file, Version 32, File size (header included) 1215234504
62307467273   0xE81D08009     LZMA compressed data, properties: 0x5D, dictionary size: 73138176 bytes, uncompressed size: 4064746276382930044 bytes
62352081571   0xE847942A3     Uncompressed Adobe Flash SWF file, Version 15, File size (header included) 3906852731
62360383829   0xE84F7F155     LZMA compressed data, properties: 0x5D, dictionary size: -919535616 bytes, uncompressed size: 365108043805695494 bytes
62361701650   0xE850C0D12     LZMA compressed data, properties: 0x5D, dictionary size: -1233387520 bytes, uncompressed size: 9192010719985262417 bytes
62422697376   0xE88AEC5A0     Certificate in DER format (x509 v3), header length: 4, sequence length: 2135
62433792502   0xE895811F6     LZMA compressed data, properties: 0x5D, dictionary size: 1457455104 bytes, uncompressed size: 7640232335065180936 bytes
62442101297   0xE89D6DA31     LZMA compressed data, properties: 0x5D, dictionary size: -311820288 bytes, uncompressed size: 5017487224196718706 bytes
62454930003   0xE8A9A9A53     Uncompressed Adobe Flash SWF file, Version 67, File size (header included) 1982155663
62481583475   0xE8C314D73     Uncompressed Adobe Flash SWF file, Version 16, File size (header included) 842444556
62491210704   0xE8CC433D0     LZMA compressed data, properties: 0x5D, dictionary size: -847577088 bytes, uncompressed size: 4510595403222360816 bytes
62501270919   0xE8D5DB587     MySQL MISAM compressed data file Version 1
62509780600   0xE8DDF8E78     LZMA compressed data, properties: 0x5D, dictionary size: -1386545152 bytes, uncompressed size: 6470833901798277711 bytes
62512418763   0xE8E07CFCB     LZMA compressed data, properties: 0x5D, dictionary size: -1303838720 bytes, uncompressed size: 4354983803664832655 bytes
62521989084   0xE8E99D7DC     LZMA compressed data, properties: 0x5D, dictionary size: 1809252352 bytes, uncompressed size: 2877649210087158927 bytes
62557848557   0xE90BD03ED     TROC filesystem, 2142186800 file entries
62560802663   0xE90EA1767     Uncompressed Adobe Flash SWF file, Version 107, File size (header included) 1682702198
62570028905   0xE9176DF69     MySQL MISAM compressed data file Version 3
62622483906   0xE949745C2     LZMA compressed data, properties: 0x5D, dictionary size: 1844379648 bytes, uncompressed size: 2510853224060172728 bytes
62652341955   0xE965EDEC3     Uncompressed Adobe Flash SWF file, Version 76, File size (header included) 3659229454
62685042534   0xE9851D766     Uncompressed Adobe Flash SWF file, Version 82, File size (header included) 4015553640
62697798679   0xE99147C17     LZMA compressed data, properties: 0x5D, dictionary size: 146669568 bytes, uncompressed size: 4573553652826860487 bytes
62699810002   0xE99332CD2     PARity archive data - file number 20158
62710018947   0xE99CEF383     MySQL MISAM compressed data file Version 7
62712764124   0xE99F8D6DC     LZMA compressed data, properties: 0x5D, dictionary size: 65732608 bytes, uncompressed size: 7597355933296428476 bytes
62752875144   0xE9C5CE288     Uncompressed Adobe Flash SWF file, Version 14, File size (header included) 1623226578
62765338649   0xE9D1B1019     Uncompressed Adobe Flash SWF file, Version 73, File size (header included) 356137353
62796056623   0xE9EEFC82F     Uncompressed Adobe Flash SWF file, Version 75, File size (header included) 830595849
62818403584   0xEA044C500     MySQL MISAM index file Version 1
62826019514   0xEA0B8FABA     LZMA compressed data, properties: 0x5D, dictionary size: 289013760 bytes, uncompressed size: 8561962619585991282 bytes
62843673533   0xEA1C65BBD     Uncompressed Adobe Flash SWF file, Version 63, File size (header included) 1673895529
62861352275   0xEA2D41D53     MySQL ISAM index file Version 6
62865711780   0xEA316A2A4     Cisco IOS experimental microcode, for "H"
62871809229   0xEA373ACCD     Broadcom header, number of sections: 1811879010,
62872352509   0xEA37BF6FD     Uncompressed Adobe Flash SWF file, Version 46, File size (header included) 311816449
62912766971   0xEA5E4A3FB     HPACK archive data
62953561969   0xEA8531F71     LZMA compressed data, properties: 0x5D, dictionary size: 1124859904 bytes, uncompressed size: 6030422991665520964 bytes
62965416645   0xEA90802C5     LZMA compressed data, properties: 0x5D, dictionary size: -2059272192 bytes, uncompressed size: 9218576816601013656 bytes
62969008871   0xEA93ED2E7     LZMA compressed data, properties: 0x5D, dictionary size: -439615488 bytes, uncompressed size: 9125414184307085061 bytes
62973814276   0xEA9882604     Uncompressed Adobe Flash SWF file, Version 89, File size (header included) 4082792510
62988436106   0xEAA67428A     Uncompressed Adobe Flash SWF file, Version 106, File size (header included) 3241855911

i did not know where this data is included... It may be here - 402652160 0x17FFFC00 Linux EXT filesystem, blocks count: 59463283, image size: 60890401792, rev 1.0, ext4 filesystem data, UUID=9c665de0-9d83-42e0-bd1d-34377c027c02, volume name "data" So how can i extract it with binwalk or any other tool ? Did this block contains my data ? Thanks in advance

Improve this question
2
  • 1
    did you try binwalk -e Userdata.bin or binwalk --dd=".*" Userdata.bin?
    – R4444
    Jun 7, 2021 at 4:59
  • Yes i have tried.. binwalk -e Userdata.bin or binwalk --dd=".*" Userdata.bin both command giving same output... gzip, lzma, and a lot of files and no files can not be extracted... The userdata is only 225gb ( exactly it is only around 20gb) it shows 225 because this mobile have 256gb internal storage. This is encrypted data so before extracting the data it should be decrypted... but i did not know how to do it....... Anybody please help
    – pdjam
    Jun 25, 2021 at 2:47

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.