Incnis Mrsi
Lurker
Note: no longer an acute problem. Data successfully recovered in another way.
——————————————————
Recently I lost some (relatively) short, but valuable, amount of text in a UI glitch of some app. Its name is presumedly “com.mediatek.notebook”; it has android.permission.READ_NOTEBOOK and android.permission.WRITE—_NOTEBOOK permissions, that suggests it stored my texts in Android’s internal storage. The glitchy app is still running, so I opted first try to break into memory space of the running process.
I rooted the device via USB (without rebooting) using instructions from there and there, located the process, and entered its /proc/pid. The system even has gdbserver already installed. What should I do to get memory dump of the process without compromising other possible recovery pathways (such as scanning filesystem garbage)?
P.S. Found all data needed in files in /data/data/com.mediatek.notebook/databases/. Posting retained in a hope that my experience may be reused by other people.
——————————————————
Recently I lost some (relatively) short, but valuable, amount of text in a UI glitch of some app. Its name is presumedly “com.mediatek.notebook”; it has android.permission.READ_NOTEBOOK and android.permission.WRITE—_NOTEBOOK permissions, that suggests it stored my texts in Android’s internal storage. The glitchy app is still running, so I opted first try to break into memory space of the running process.
I rooted the device via USB (without rebooting) using instructions from there and there, located the process, and entered its /proc/pid. The system even has gdbserver already installed. What should I do to get memory dump of the process without compromising other possible recovery pathways (such as scanning filesystem garbage)?
P.S. Found all data needed in files in /data/data/com.mediatek.notebook/databases/. Posting retained in a hope that my experience may be reused by other people.
Last edited: