[Galaxy S 5 Q&A, Help & Troubleshooting] fewclues:
S5 internal sdcard photo recovery working around FUSE & Samsung Knox

I have a similar problem, have used the guide -- and the guide may have worked with an older version of Android, but not with mine. I own a Verizon Samsung Galaxy S5 (SAMSUNG-SM-G900V) with Android version 4.4.4. Just like the original post, it has a gel case because my last phone, a HTC Incredible, had a hard case, one of the case's corners broke off and -- when I accidentally dropped it on that corner -- the screen cracked.

While removing the fairly tight gel case, some combination of buttons got pressed (again, like the original posting), I OK'd a screen & the phone reset to factory defaults, making six months worth of pictures & videos I had stored on the internal flash memory disappear. They weren't being backed up to Google, Samsung or Verizon because I preferred backing them up to my PC (which I also back up) & hadn't done the backup for 6 months.

I searched the web & tried the data recovery steps in the URL mentioned in the last reply to this post:

http://xdaforums.com/galaxy-nexus/general/guide-internal-memory-data-recovery-yes-t1994705

which forced me to root the phone, but Recuvra didn't find any pictures. I also tried the steps in this link:

http://www.df.lth.se/~jokke/androidfilerecovery/

which also didn't work. This link was informative:

http://androidcreations.weebly.com/how-to-get-android-mounts-and-partition-images.html

but didn't help me find where the pictures were. This web page talks about the S5 FUSE file system which allows both the S5 and a PC talking with it to access the phone's user data:

http://www.all-things-android.com/content/review-android-partition-layout

I used adb to run 'su' & 'mount' and got a list which included the following lines:

tmpfs /storage/emulated tmpfs rw,seclabel,nosuid,nodev,relatime,mode=050,gid=1028 0 0

/data/knox/sdcard /mnt/shell/knox-emulated sdcardfs rw,nosuid,nodev,relatime,uid=1000,gid=1000,derive=none 0 0

/data/privatemode /mnt/shell/privatemode sdcardfs rw,nosuid,nodev,relatime,uid=1000,gid=1000,derive=none 0 0

/data/media /mnt/shell/emulated sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023,derive=legacy,reserved=20MB 0 0

/dev/block/vold/179:65 /mnt/media_rw/extSdCard vfat rw,dirsync,nosuid,nodev,noexec,noatime,nodiratime,uid=1023,gid=1023,fmask=0007,dmask=0007,allow_utime=0020,codepage=cp437,iocharset=iso8859-1,shortname=mixed,utf8,errors=remount-ro 0 0

/mnt/media_rw/extSdCard /storage/extSdCard sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023,derive=unified 0 0

/data/media /storage/emulated/0 sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023,derive=legacy,reserved=20MB 0 0

/data/media /storage/emulated/0/Android/obb sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023,derive=legacy,reserved=20MB 0 0

/data/media /storage/emulated/legacy sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023,derive=legacy,reserved=20MB 0 0

/data/media /storage/emulated/legacy/Android/obb sdcardfs rw,nosuid,nodev,relatime,uid=1023,gid=1023,derive=legacy,reserved=20MB 0 0

and think that my data is probably under the /data/knox/sdcard file system. However, I'd like to get that filesystem as a file -- I think it's the Linux ext4 filesystem -- and use the extundelete utility available on my Ubuntu Linux to try to recover that filesystem. My problem is that I'm not sure how to do it.

Furthermore, because the name /data/knox/sdcard had 'knox' in it, I looked up knox and it's apparently some sort of security software used by Samsung:

https://www.samsungknox.com/en/support/knox-workspace/faqs?field_faq_category_tid=1028

Even if I were able to find the Android file which contains the FUSE ext4 filesystem, I'm not sure what Samsung Knox would do, maybe scramble it? There never has been an encryption password on the system, so maybe Knox is inactive.

Can anyone explain how to get a copy of the ext4 filesystem which holds the Samsung Galaxy S5 photos onto a Linux machine? Once on the Linux machine, I can mount it using Linux's FUSE and try to use extundelete to find the photos. (Or, if there is an easier way, I'd like to hear it.)