twrp_extract_files.py

#!/usr/bin/env python3

BACKUP_FILE = 'backup.ab'

# Constants
# ref: https://github.com/omnirom/android_bootable_recovery/blob/android-7.1/adbbu/twadbstream.h
TWRP = b'TWRP' + b'\x00\x00\x00\x00'

TWSTREAMHDR = b'twstreamheader'
TWFN = b'twfilename'
TWIMG = b'twimage'
TWDATA = b'twdatablock'
MD5TRAILER = b'md5trailer'
TWENDADB = b'twendadb'


class ParseError(Exception):
    pass


with open(BACKUP_FILE, 'rb') as backup_file:
    initial = backup_file.read(10240)  # size picked randomly
    backup_file.seek(initial.find(TWRP))

    while True:
        block_header = backup_file.read(8)
        if block_header != TWRP:
            pos = backup_file.tell() - 8
            raise ParseError(
                f'Expected TWRP header, got: {block_header} ({pos})'
            )
            
        block_type = backup_file.read(16).rstrip(b'\x00')
        
        if block_type in (TWSTREAMHDR, TWENDADB):
            # AdbBackupControlType
            block_crc = backup_file.read(4)
            backup_file.seek(484, 1)

            if block_type == TWENDADB:
                # We should have reached the end of the backup file
                break

        elif block_type in (TWFN, TWIMG):
            # twfilehdr
            block_size = backup_file.read(8)
            block_compressed = backup_file.read(8)
            block_crc = backup_file.read(4)

            name = backup_file.read(468).rstrip(b'\x00')
            file_name = name.split(b'/')[-1].decode()
            output = open(file_name, 'wb')

            print('Extracting', block_type.decode(), name.decode())

        elif block_type in TWDATA:
            # AdbBackupControlType + data
            block_crc = backup_file.read(4)
            backup_file.seek(484, 1)

            # Write out data in block
            output.write(backup_file.read(1048064))  # (1024 * 1024) - 512

        elif block_type == MD5TRAILER:
            # AdbBackupFileTrailer
            block_crc = backup_file.read(4)
            block_ident = backup_file.read(4)
            block_md5 = backup_file.read(40)
            backup_file.seek(440, 1)

            output.close()

        else:
            pos = backup_file.tell() - 24
            raise ParseError(
                f"Unknown block type: '{block_type}' ({pos})"
            )

Does this work with encrypted partitions? I used the tool, I have the tar and it reads it but then I get

tar: Ignoring unknown extended header keyword 'TWRP.security.fscrypt'
tar: Removing leading `/' from member names
tar: Ignoring unknown extended header keyword 'TWRP.security.fscrypt'
tar: Malformed extended header: missing equal sign
tar: Ignoring unknown extended header keyword 'TWRP.security.fscrypt'
... (Truncated as it's repetitive and too big for GitHub comments probably)
tar: Exiting with failure status due to previous errors

given it has crypt in the name, I'd suspect it means it's encrypted so it is failing to read the tar properly, even though twrp should've decrypted it (if I had to assume), it didn't, would it be possible to add functionality to supply a password and if it detects that header above (TWRP.security.fscrype) try to decrypt it with the password supplied?

Hi @JordanPlayz158 unfortunately my knowledge of the TWRP backup files is very limited. This script was written using a bit of guess work as I only had the twadbstream.h file to work from. The backup file I was working with didn't have encryption, so I'm not sure what would be involved in decrypting the backup.

Thank you so much. Please publish this as a standalone to save people lives. I was almost breaking to cry because I made a backup, assumed it was working and just deleted 2 years of my life from my phone after a corrupt system upgrade. I had a hard time finding this thread.

Thank you so much. Please publish this as a standalone to save people lives. I was almost breaking to cry because I made a backup, assumed it was working and just deleted 2 years of my life from my phone after a corrupt system upgrade. I had a hard time finding this thread.

Same happend with me but in my case I lost my phone efs partition and don't know how to extract it from backup.
Finally I found this after two days of searching, such a life saver..