Extracting data from a TWRP backup

Question

How can I extract individual files from a backup created with TWRP? I’ve come across this answer, which is about extracting an APK from the system partition. However, I want to extract files from /data, which gets split across several files in the backup.

user149408 · Accepted Answer

The files created by TWRP with a *.win or *.win??? extension are tar archives. If a partition gets split across multiple files, each is a tar archive in its own right. Simply rename each file, giving it a .tar extension, and open it in your favorite archive tool (Engrampa on Ubuntu MATE has worked well for this).

Nottheone7 · Answer

Just extract it with winrar to a folder on desktop and that's it

Johnathon Havens · Answer

cat data.ext4.win??? | tar xvfi -
What this does is concatenate each file matching the pattern data.ext4.win??? and then pipe the concatenated files to tar for extraction. the - as the filename tells tar to extract from stdin. The i option ignores zero blocks which will be in between each archive file concatenated.
In this example I used the ext4 formatted data partition. Change data.ext4 to match the partition you are extracting.
Disclaimer: This has not been tested in a windows environment.

For a less hacky solution found here
for f in data.ext4.win???; do tar xvf "$f"; done
This is a bit simpler without relying on the ignore zeros option of tar to operate properly

Edited to reflect davidgo's comment.
31-Jan-2020 Edited to reflect Code Bling's comments.
17-Feb-2021 Edited to reflect alecxs's comments.

M. A. · Answer

Try BinWalk, it's a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images. and for more information take a look at this Quick-Start-Guide.

Extracting data from a TWRP backup

4 Answers

Add your own answers!

Ask a Question