Extracting data from a TWRP backup

The files created by TWRP with a *.win or *.win??? extension are tar archives. If a partition gets split across multiple files, each is a tar archive in its own right.

There is a slight difference, depending on the TWRP version used to create the backup. The watershed seems to be 3.2.* or before.

If the backup was created with an older version:

The files are in standard TAR format which any Unix-like OS should understand. Simply rename each file, giving it a .tar extension, and open it in your favorite archive tool (Engrampa on Ubuntu MATE has worked well for this).

If the backup was created with a recent version:

The file format uses custom TAR extensions, which the standard tar tools cannot process, see https://github.com/TeamWin/Team-Win-Recovery-Project/issues/1472. You need to extract the file with TWRP’s own flavor of tar:

• If the backup is no longer on the device, copy the required file back. (Should work on any device with TWRP, regardless of where the backup was created.)


• Boot into TWRP.


• adb shell into the device.


• cd to a folder where you want to store your extracted files (I recommend creating a temporary one, extracting files there and then copying them to their intended destination – gives you some security against accidentally overwriting parts of your filesystem).


• Extract those files with TWRP’s custom tar build:
  
  
  
  • tar -tvf data.ext4.win000 will list all files in that particular backup archive (use grep to search for something particular).
  
  
  • tar -xvf data.ext4.win000 path/to/file will extract the specified file. In my case, TAR removed the leading / from file names and placed the extracted file in the current folder, with the path appended.
  
  
  
  

Another option would be to build TWRP’s custom tar tool on a system of your choice, then do the extraction on that system.