unmount the disk before scanning!
ntfsundelete
autopsy
disk drill
recuperabit(good for small files)
recoverpy
korczis/foremost
could also try to retrieve from android phones (/data/data/tv.danmaku.bili)
https://roubert.name/joakim/androidfilerecovery/
apt-get install testdisk pv extundelete
adb shell ls /dev/block
Now let us dump the content of that /dev/block/mmcblk0 that we found to the computer. With adb shell we can become superuser and execute cat to dump the content like this:
$ ./adb shell su -c “cat /dev/block/mmcblk0” | pv > mmcblk0.raw
Pipe Viwer (pv) is optional, but I like to see the transfer progress information it provides.
(And of course you can change mmcblk0.raw to some other directory/filename if you want to.)
Addition: André Paixão wrote to me that he just got an empty file with the command above. He solved it by using adbd insecure.
Addition: Daniel Jeliński wrote to me that he ran into issues with LF encoding. The solution that worked for him was:
./adb shell su -c “cat /dev/block/mmcblk0” | pv | sed ‘s/^M$//‘ > mmcblk0.raw
…where ^M is what you get by pressing Ctrl+V followed by Ctrl+M.
Addition: Marc also ran into the LF problems, but solved it this way:
./adb shell “su -c ‘stty raw; cat /dev/block/mmcblk0’” | pv > mmcblk0.raw
Addition: Tim de Waal wrote to me that he prefers using netcat/gzip instead:
On the Android device (adb shell with su), run:
dd if=/dev/block/mmcblk0 | gzip -9 | nc -l 5555
On the computer, run:
nc [AndroidIP] 5555 | pv -b > mmcblk0.img.gz
testdisk mmcblk0.raw