Recovering Android Photos with Linux

As noticed by others on the Internet, it is possible to recover photos from an Android phone that were deleted. It is impossible, as far as I know, to recover the full resolution photos. You may, however, recover the thumbnails and those are often large. This also allows you to recover photos which weren't saved, like those from text messages. The problem though is that methods I found while googling require you to edit the image files in a hex editor. For example, as demonstrated in this video. I've instead written a python script which automates this greatly simplifying the fact that you need to recover all the pictures to find one in particular.





The approach is to write a short python script which automates the hex editing necessary and then execute the script on all the cache files. Pretty straight forward. As usual, this only works on Linux and I have no idea about other OSes.

The first step is to find your tec cache files. Plug the phone into a computer and turn on USB storage. Navigate around until you find any tec files, which are cached thumbnails. For me, the path is /sdcard/DCIM/Camera/cache

Once you have the files on your computer in a folder (do not edit the originals on your phone!), you need to open a text editor to create the python script. This script in python is pretty simple:

	#!/usr/bin/python
	import sys
	#open the tec file (first command line argument) in binary mode
	fin = open(sys.argv[1], 'rb')
	#open the jpg file for output (second command line argument) in binary mode
	fout = open(sys.argv[2], 'wb')
	#Read in the file
	data = fin.read()
	#The important part: remove the first 8 bytes and remove the last byte
	fout.write(data[6:-1])
	#close the file
	fin.close()
	fout.close()

view raw gistfile1.py hosted with ❤ by GitHub

Once you have that python script written in a text file, for example "tec2jpg.py", make it executable with

chmod +x tec2jpg.py

The final ingredient is to execute the python script on all the tec files in a directory. This can be done using this little bash for loop in the command line when you are in the directory containing the tec files:

for i in `ls *tec`; 
  do NAME=`basename $i .tec`;  
  path/to/python-script/tec2jpg.py $NAME.tec $NAME.jpg; 
done;

That's it! You should at this point have jpegs for all the original tec cached thumbnails. I have only tested this on my Samsung galaxy, so I have no idea if it works on other phones. Best of luck!