Get files from eMMC

VIM1
1

Hi, dudes!
I have VIM1 (v1.2) with broken unrecognized OS. I can boot the device only with Krescue, no Ubuntu (server or gui) starts from Flash/SD…
How can I get files(not image) from this OS? I have got image from eMMC to SD-card with Krescue, but it doesn’t open in any program (7-zip or UltraISO) and says image is corrupted.

2

@boltogram21 which version of Ubuntu and kernel did you use ?
did you try to see if you can recognize the eMMC from Krescue’s CLi ?

3

@Electr1 I tried VIM1_Ubuntu-server-bionic_Linux-4.9_arm64_SD-USB_V20191231 and VIM1_Ubuntu-xfce-bionic_Linux-4.9_arm64_SD-USB_V1.0.5-210430. From Krescue shell I didn’t find how to see files on eMMC… Maybe eMMC should be mounted by hands? I saw videos on YouTube with Krescue functions, but didn’t find instructions how to see and get files.

4

@hyphop is it possible to decompress a krescue image?

5
  1. start krescue
  2. goto Shell
  3. common linux steps
blkid | grep ROOTFS && echo OK
/dev/mmcblk2p2: LABEL="ROOTFS" UUID="89020883-b8f1-4f79-9a74-ac418c5f41da" TYPE="ext4"

mkdir rootfs
mount LABEL=ROOTFS rootfs
cd rootfs
ls -l1

PS: before recovery make backup for safety

Krescue Backup image

all backup images is simple raw images (cloned from your emmc ) and compressed by standard gzip zstd or xz compression

*.zst - zstd comression
*.gz - gzip comression
*.xz - xz/lzma2 comression
*.raw - raw not compressed image

i can write basic steps only for *nix users - how to extract files from backup images

1 Like
6

did you try mainline kernel image ?

7

i can write basic steps only for *nux users - how to extract files from backup images

Please, do. I’m just using debian.

blkid | grep ROOTFS

This command returns me nothing…

1 Like
8

What image do you mean?

9

Mainline image has kernel number like 5.x
like: VIM1_Ubuntu-gnome-focal_Linux-5.12_arm64_SD-USB_V1.0.6-210520

10

Just tried. Result is the same…

11

@hyphop, please write how to decompress eMMC image in Linux to get files! Thanks in advance!

12

How-To restore files from krescue dump image - basic example

Create dump image

Goto main menu => Image DUMP from < EMMC => dump image

Or do same via command line image_dump2sd in shell

Extract files from image for linux machine

VIM3L.1624261055.1073741824-bytes.emmc.img.zst - basic dump image name

dump images can be zst|gzip or raw(without) compression

  • *.img.zst - zstd compression
  • *.img.gz - gzip compression
  • *.img - raw image as is without compression
file VIM*.img*

VIM3L.1624261055.1073741824-bytes.emmc.img.zst: Zstandard compressed data (v0.8+), Dictionary ID: None
VIM3L.1624261677.1073741824-bytes.emmc.img.gz:  gzip compressed data, was "VIM3L.1624261677.1073741824-bytes.emmc.img", last modified: Mon Jun 21 07:48:03 2021, from Unix, original size modulo 2^32 1073741824

Unpack image

zstd -dc VIM3L.1624261055.1073741824-bytes.emmc.img.zst > unpacked.img
# or
gzip -dc VIM3L.1624261677.1073741824-bytes.emmc.img.gz > unpacked.img

Check raw image

file unpacked.img
# basic output
unpacked.img: DOS/MBR boot sector; 
partition 1 : ID=0xe, start-CHS (0x20,0,1), end-CHS (0x9f,3,16), startsector 2048, 204800 sectors;
partition 2 : ID=0x83,start-CHS (0xa0,0,1), end-CHS (0x29f,3,16), startsector 206848, 819200 sectors

other way to get same information about image

sfdisk --dump unpacked.img

label: dos
label-id: 0x4a015514
device: unpacked.img
unit: sectors

unpacked.img1 : start=        2048, size=      204800, type=e
unpacked.img2 : start=      206848, size=      819200, type=83

Mount image partitions

mkdir -p boot system
## 1st offset by 2048 block - real offset can have other value
sudo mount -o offset=$((2048*512)),sizelimit=$((204800*512)) unpacked.img boot
## 1st offset by 206848 block - real offset can have other value
sudo mount -o offset=$((206848*512)),sizelimit=$((819200*512)) unpacked.img sys
#
df boot sys
#
Filesystem     1K-blocks  Used Available Use% Mounted on
/dev/loop46       102182     2    102180   1% /tmp/boot
/dev/loop47       388462  2319    361567   1% /tmp/sys
#
blkid /dev/loop46 /dev/loop47
#
/dev/loop46: SEC_TYPE="msdos" LABEL_FATBOOT="BOOT" LABEL="BOOT" UUID="0462-056F" TYPE="vfat"
/dev/loop47: LABEL="SYSTEM" UUID="88e3746d-5944-4f56-9d7d-22d8cd99583c" TYPE="ext4"

list files

ls boot sys -l1

boot:
total 2
-rwxr-xr-x 1 root root 1 Jun 21 15:32 README.fat.txt

sys:
total 13
drwx------ 2 root root 12288 Jun 21 15:31 lost+found
-rw-r--r-- 1 root root     1 Jun 21 15:32 README.ext4.txt

Umount image

sudo umount -d sys boot

try to fix broken fs

For some cases we cant mount fs becouse its broken, and 1st step is fs recover

losetup -f --show --offset=$((206848*512)) --sizelimit=$((819200*512)) unpacked.img
#
/dev/loop46

fsck.ext4 -yf /dev/loop46
#
e2fsck 1.45.5 (07-Jan-2020)
...
SYSTEM: 12/102400 files (0.0% non-contiguous), 23457/409600 blocks

unprivileged user access example

e2ls /dev/loop46
README.ext4.txt     lost+found

mount recovered fs

sudo mount -o ro /dev/loop46 sys

Extract files from broken/unrecoverable fs

Same possible rescue some files from broken disks for example by photorec from testdisk package
sudo apt-get install testdisk

photorec unpacked.img

PS: if your files provide real value to you please contact a professional…

4 Likes
13

Thanks for your reply, bro!

1 Like