[General Questions and Answers] psychicteeth:
Hey folks,

Bit of a long story, short version is "Phone seems wiped, did I mess up? If not how is it possible?"

I've been passed a device with a report that it had an important video file on it that was accidentally deleted, and tasked with seeing if the file was recoverable. I was also later passed the only SD card (2gb) in the owner's possession.

Phone first. I followed instructions to root the device and rip an image of the data partition. This did mean uploading the root zip to the phone, a risk I undertook before discovering you can get a temporary root. I don't think that act accounts for what I found.

I used these two [1] [2] links for guidance. Ripping the data took many attempts but I did eventually get a 32gb-ish image down the wire. The image seemed to mostly be zeroes viewed in hex editor. Video-wise, recovery software found only operating system background videos of clouds. There didn't seem to be any user data on there at all. Recovery seemed to run very quickly with image stored on an SSD. As I say, even if I'd overwritten the video file header with the root zip, there'd have been other data on there, seems to me. Other photos. Other videos. Perhaps I ripped it wrong. Ripped on a windows machine. Is ripped even the right word, I'm not very good at this and a bit stressed

Did I get the wrong partition? Wouldn't be 32gb then though, right? I ripped mmcblk0 and mmcblk0p37 or whatever seemed to be mounted as the data partition, various times, and got similar results regardless of the resultant file size (i.e. stop half way through, data is mostly zeroes, get the whole image, it's mostly zeroes, all ripped images contain the OS video files).

Did rooting / flashing recovery wipe the data? Seems unlikely. I did start the phone by accident at one point (reboot from recovery seemed not to acknowledge my holding down the volume / power combo to get back into recovery) and OS claimed to be "upgrading all the apps" so I powered it down straight away. This is the terrifying moment for me, did something I do kick off an OS process that wiped the phone?

Owner claims never to have done a factory reset, and in any case that doesn't wipe data anyway right? Only file table. So data would still be there. But like I say they don't claim to have wiped phone, only accidentally deleted files. Even automatic OS upgrade would leave data intact. Flashing a mod would do it I guess but that's not happened.

SD card next, it's labelled "BLACKBERRY" and owner did have a bb once. They say the card was in the phone, I figured maybe phone was using sdcard instead of internal memory for user data but the card is essentially blank, it's like it has never been used since it was formatted by the blackberry. No data on it, just 6 folders. Recovery software finds literally nothing. Seems like a dead end. Ripped on a mac using dd.

Possible that the owner had another sdcard at some point but they cannot recall having one.

Also possible I ripped the data wrong? I used sudo dd to get it, then ran Disk Drill on the mounted .dmg, which is 2gb, the size of the sd card.

dd would not substitute zeroes for unallocated filetable areas, right?

So this leaves me with so many questions about how we got to this point with no data, but mainly I want to sanity check what I've done here so I can be more confident I haven't wiped the data I'm trying to recover myself. Then it'll be a case of digging deeper into what happened to this phone between the video being taken, the video being deleted, and the phone arriving in my hands.

Thanks in advance to anyone for literally any input!!