Last week I had to backup a semi-broken phone (a Meizu M2 Note) before trashing it, and by mistake I deleted some important photos during the transfer. Problem is that at some point Android removed the possibility to connect the phone as USB mass storage, which exposed internal memory and so allowed to make a perfect image. Note that depending on your device enabling USB debugging may enable mass storage mode, so try that before the following method. After some trial and error I found a clean solution that I hope someone can find helpful, it should work on Windows and Linux (I used the latter). Here it is, in broad terms:

You need rooted phone, adb and phone’s USB drivers installed on your computer, and Android USB debugging enabled.

Connect the phone to the computer via USB and open the terminal (you may need to be in the same path of adb, depending on your installation), open the Android internal Linux shell with the command adb shell, here give the command cat /proc/partitions to see the partition list, the output will be like this:

major minor  #blocks  name

   7        0      98304 loop0
 179        0   30535680 mmcblk0
 179        1      65536 mmcblk0p1
 179        2       1024 mmcblk0p2
 179        3        512 mmcblk0p3
 179       27     716800 mmcblk0p27
 179       28   28551146 mmcblk0p28
 179       29          5 mmcblk0p29
 179       32       4096 mmcblk0rpmb

Note that virtual partitions aside there is one main drive (probably mmcblk0 like the example, but check the name) and its partitions (a lot of), note which is the largest (#blocks is the size) because it’s probably where all your data is, anyway you will be able (and I suggest you) to backup the entire internal memory.

Now you need to gain superuser rights (just type su, but mind that you can do real damage from this point) and change permissions of the drive file with chmod +r /dev/block/mmcblk0 (change if your disk name is different), this cause a really critical security issue, so be sure to revert it as you will read later. Exit the Android shell with a double exit.

Finally clone the entire memory with adb pull /dev/block/mmcblk0 "mmc.img", substitute with the desired image filename (or path), it will take some time. Alternatively you may want to clone only a chosen partition, in this case follow the last two steps replacing mmcblk0 with the partition name (like mmcblk0p28).

Now revert the permission change reentering adb shell, then su, and chmod 600 /dev/block/mmcblk0. Alright.

If you were interested only in cloning the memory you are done, otherwise to recover files (deleted or not) use the software of your choice or see the following tips.

Before continuing better make a copy of the image and leave the original untouched.

I won’t be precise and you may have to look elsewhere for detailed steps, anyway, first step in recovery is to recreate partition tables with testdisk, just follow the steps, partition table is probably GPT but try both GPT and MBR and see which correctly detects partitions. Then with the same software you will be able to undelete (because filesystems usually just mark files as deleted, do not really erase them) and export files. Another option is to throw the image to photorec, which come with testdisk; it has a completely different approach as it search traces of known file types byte per byte, ignoring filesystem, so you end up with a lot of “random” named files hard to organize (well, you can for example select just JPGs bigger than 500 KB or something like that).

Hope this helped.