Recovering data from Mi 4c able to get only to fastboot

Question

my phone has fallen and it cannot boot. The only accessible thing is fastboot, but even there I cannot flash TWRP.

When I try to flash TWRP 3.1.1 or 3.1.0 I get:

>fastboot.exe flash recovery twrp.img

target reported max download size of 536870912 bytes

sending 'recovery' (21100 KB)...

OKAY [  0.483s]

writing 'recovery'...

FAILED (status read failed (Too many links))

finished. total time: 0.544s

The phone is unable to boot at all. So adb is out of question.

Additional info that may help:

>fastboot.exe getvar all

(bootloader) version:

(bootloader) token:OrhCgsF/c0ZJ0PDtn3UZAR4A

(bootloader) sec_boot:TRUE

(bootloader) variant: eMMC

(bootloader) secure:yes

(bootloader) version-baseband:

(bootloader) version-bootloader:

(bootloader) display-panel:

(bootloader) off-mode-charge:0

(bootloader) charger-screen-enabled:0

(bootloader) max-download-size: 0x20000000

(bootloader) partition-type:cache:ext4

(bootloader) partition-size:cache:

 0x18000000

(bootloader) partition-type:userdata:ext4

(bootloader) partition-size:userdata:
 0x683bfbe00

(bootloader) partition-type:system:ext4

(bootloader) partition-size:system:

0x78000000

(bootloader) soc_id:251

(bootloader) serialno:10adc264

(bootloader) kernel:lk

(bootloader) product:MSM8992

all:

finished. total time: 0.217s

From this message I believe the storage chip is done for but you never know.

The phone claims to be unlocked (it should be as I use custom ROM). Physically there does not appear to be any damage, but when battery is connected it does not start at all.

I wanted to use TWRP ability provide data through MTP. There is TWRP installed, but it was accessible by updater application where was option to reboot to TWRP. So TWRP should be already there. But when pressing volume down button during boot I get only to fastboot.

Is there any way how to get at least to my data or is the phone completely done?

EDIT:

Tried advice from Robert in comments to directly boot TWRP.

>fastboot.exe boot twrp.img

downloading 'boot.img'...

OKAY [  0.500s]

booting...

FAILED (status read failed (Too many links))

finished. total time: 1.150s

Also advice from alexcs in comments does not yield any results. The phone cannot boot to recovery.

— Filip | Sources

Answer

Success! Thank you @alecxs for help and resources.

1 Obtain a programmer

To successfully acquire all of the data from EDL you need programmer.

For Mi 4c it is prog_emmc_firehose_8992_ddr.mbn that can be obtained in (first?) official image of OS. I got it from file Xiaomi_Mi_4C_V8.1.3.0.LXKCNDI_20161213_China_5.1_XFT.zip on some random site. You can find it in the archive under folder Firmware/images/.

The full path in archive would be Firmware/images/prog_emmc_firehose_8992_ddr.mbn.

2 Get working Firehorse

I have got mine from repository: https://github.com/bkerler/edl.

Proceed with all instructions mentioned in the repository. (I personally used Ubuntu 20.04 as all of the stuff is easier to make work.)

3 Connect to EDL

Boot phone to fastboot. In case of Mi 4c that is my case it is pushing volume down during boot.

When you enter fastboot and you can see your device with fastboot:

fastboot devices

In case of Mi 4c you can directly boot to EDL with command:

fastboot oem edl

4 Acquire data through EDL

When device enters EDL state you can test connection with programmer (in my case prog_emmc_firehose_8992_ddr.mbn). In loader parameter you are entering path to this file.

./edl.py --loader=prog_emmc_firehose_8992_ddr.mbn printgpt

When it outputs all of the partition then you are golden!

On my phone there is one partition named userdata:

userdata: Offset 0x00000000c4000000, Length 0x0000000683bfbe00, Flags 0x00000000, UUID 07c2b899-1574-564c-2f46-e26a6378bdd8, Type 0x1b81e7e6

To acquire the partition use command:

./edl.py --loader=examples/prog_emmc_firehose_8992_ddr.mbn r userdata userdata.bin

The copy of user data just needs to be read.

5 Reading user data (userdata.bin)

Luckily for the phone Mi 4c you can directly mount the dump in Linux. For some other phones the process might not be so straightforward and you might need simg2img. But I am not 100% sure.

sudo mkdir /media/userdata

sudo mount -t ext4 -o loop userdata.bin /media/userdata/

To read the data you will need to get root rights as the data belong to non-existing or different existing users and you won't get access with your user.

sudo mkdir userdata

sudo cp -r /media/userdata/media/0/* userdata/

The path to the your data might be different so take your time to look around.

Done! All the data are now completely accessible.