Recovering the deleted data from Android SD Card ?

Question

I am trying to make an Android application which would try to recover deleted content from the SD Card. How feasible is it? I have the following methods in mind:

1. Since, the files are not actually deleted, can I access the file system to see files which has been marked to be overwritten.
2. Or will I have to do header/footer file carving? Is it possible from the application layer of android?

I am concerned about files stored on contiguous sectors and not the fragmented ones. I want to do a basic file retrieval.

Please let me know some resources which I can use to make this application?

Answer 1

You can't do this with the Java Android API. It can only be done on "jailbroken" phones or by installing linux applications directly on the phone, i.e. in its /system area.

And if you go for it, there sure exists linux command line applications that do this already. You'll have to look out for one that can go along even with small amounts of RAM to execute on.

Answer 2

You might be able to do this in C/C++ using the Android NDK. I think your application would require root access however.

Answer 3

SD cards on Android phones are formatted with FAT32, so any program that can recover deleted files from a FAT32 file system can recover from the Android SD card. Easiest for you will be using SleuthKit (http://sleuthkit.org). Use the "fls" command to list the directory and file the cluster number of the deleted file, then use "icat" command to output it. If you want to write an application, you can use the SleuthKit library and link your Android application to SleuthKit using the native interface provided by Android.

Good Luck.