My Tecno Spark 10 Pro (MediaTek Helio G88, Android 12) bootlooped after a banking app froze. Now it boots straight into stock recovery with the message that Android cannot be loaded and data may be corrupt. The bootloader is unlocked. I hooked it up to an Android tablet via OTG with Bugjaeger. The device uses A/B partitioning and was running on slot b. I switched it to slot a via fastboot, but slot a gives the exact same recovery loop, so the issue is clearly a corrupted userdata partition failing to mount during early init. All I need is my local KeePass database file from internal storage. I know modern Android uses File-Based Encryption with keys sealed in the TEE, but since my bootloader is unlocked, is there any known way via fastboot, MTK tools, or custom boot images to extract or decrypt that single file before I wipe the device? Or is it completely unrecoverable once the filesystem fails to mount?

No, unfortunately there is no way. If recovery could mount and decrypt yes, otherwise no.

Can you dirty flash a ROM? But if it's really a corrupt user data partition, probably not recoverable with the tools at hand. Maybe if it's possible to take a dump of the device, then decrypt and run file recovery on the partition image.

But I'm not familiar with that process. If it's valuable to you, I'd pay a data recovery service.

Also, this is why you should have backups.

TWRP has that option, but a lot of people have said it doesn't work.

• are you rooted?/do you get adb while booting? (few years ago on a custom rom's debug build, but i was able to connect via adb and read logcat and solve the issue it was having while stuck in bootloop and before it auto enters recovery)
• i see you have custom recovery now. can you boot a custom recovery (maybe temporarily via fastboot)?

it should be possible to recover given that you have full unrestricted access to the device and even know the lockscreen password..

seems like it's possible with twrp. btw, i've bootlooped my phone before after using twrp to wipe dalvik cache on a recent encrypted phone (it created an unencrypted dir on userdata iirc, removing the offending directory solved it), so beware and don't do anything that doesn't seem necessary!

I don't have root and I don't have custom recovery :)

maybe try booting this or this TWRP temporarily without flashing using fastboot (fastboot boot recovery_filename.img)

(kinda unlikely to be able to directly mount data though, there's one on 4PDA too dated Apr 2024 but it specifically says it doesn't support mounting data)

are you able to obtain the installed version of the firmware or extract stock boot image from device? (if the TWRP above booted, you probably can)

in that case, we may be able to enable adb during boot phase by changing some props on the boot image's initrd, and try logcat'ing to get android properly booting again.

TWRP yes, but in that case it will ask for your pin code, mount and decrypt.

If the partition cannot be mounted, like in this case, it's just plain impossible no matter which recovery.

TWRP won't load :(
The phone reboots and the error appears again

do you have the stock firmware of this device (the version installed on the phone)?

if you don't, at least please share the build version or whatever info shows on the stock recovery, fastboot/bootloader menu (if it exists), etc

Here is the exact build information from my stock recovery screen:

Device: TECNO Spark 10 Pro (TECNO/KI7-GL/TECNO-KI7)
Android version: 12 (SP1A.210812.016)
Build number: 230703V2369
Build tag: user/release-keys

I don't have the stock firmware package or scatter file on hand right now, but this is the exact build that is currently installed.

try downloading this boot.img file, and booting it with fastboot boot tecno_ki7_boot.img. let me know if it tries to boot android (shows booting animation), fails, and goes to recovery just like now.

it's from this firmware file. (most firmwares for your phone on the net is android 13, this is 12)

(if this works, my idea is to unpack the boot.img, change persist.sys.usb.config and ro.adb.secure on default.prop to gain adb during boot. then we can use logcat to fix the issue and make android boot)

It still won't start

you mean it

• tries to boot android, fails and goes to recovery?
• or it doesn't even show the boot animation and just hangs on fastboot? or reboots immediately?

i'll need details to help..

tries to boot android, fails and goes to recovery

ok. in that case you can unpack that boot image, edit default.prop in ramdisk like i mentioned above and try fetching logcat.

i'm away from my workstation for a while so i can't edit the boot image for you now. you can try it yourself, or if its fine please wait a few weeks

I can wait :) Thank you a lot

sorry for keeping you wait for so long. please try downloading this boot.img file and booting it. i've modified the original boot.img's default.prop to enable ADB.

boot that using fastboot boot tecno-ki7_boot_adb.img, and right after that run sudo dmesg -w to see any new USB device appearing. Also open another terminal and try adb devices, adb shell etc and see if you can communicate with the device while it's in the boot animation stage.

if the new boot.img i provided doesn't work please let me know, we might need to nullify vbmeta

Hey! I found a little bit of time to try it out! Thank you very much for trying to help me!
When I trying to boot it up I getting:

fastboot boot tecno-ki7_boot_adb.img
Sending 'boot.img' (26862 KB)                      OKAY [  0.655s]
Booting                                            FAILED (Status read failed (No such device))
fastboot: error: Command failed

and logs from dmesg: https://0bin.ch/?51a49ed0a5778a18#DPxaTLsafGXC2jEokDCF5mZ2YiexKJHoYkz7GCthwMNa
Also adb devices and adb shell does nothing.

hmm that's weird.

after the fastboot boot command fails, what does the device show on screen? is it stuck on fastboot? or reboots?

perhaps doing fastboot boot as sudo might help.

did you install fastboot from your linux distro's repo? what version is it? (it might be very outdated and be the cause of issues)

After fastboot command device reboots and trying to start android, I think and then just shows me error screen again.
Yeah, I tried sudo, but didn't help.
I tried 37.0.0 version too and result the same.
Idk this phone is cursed.

in some cases i've seen fastboot command return error on console but actually succeed in executing the wanted behavior, so it might be the case here that our boot.img did successfully boot.

by 'device reboots and trying to start android', do you mean the device actually rebooted again to bootloader stage (e.g. vibrate and show manufacturer logo), or just boot android without that step? an easy way to confirm this is by holding fastboot or recovery hotkey right after fastboot command. if it did reboot and start again from bootloader it will enter fastboot/recovery, but if it didn't and actually booted our new boot.img it would just boot android

after fastboot boot error I immediately held volume up and the phone showed TECNO logo and then went to "No command" screen.

ah, damn. it seems like it completely failed to boot...

i'll try another go at making a new boot.img and let you know soon. kinda out of ideas at this point tbh.

hey can you confirm that the original unmodified boot.img doesn't return failed while the new one does?