How to recover open opera tabs from backup data after phone bricked?

I had more than 200 tabs open on opera and they would normally reopen again, even after reboots.

My phone broke, but I have a backup of the external SD Card, internal SD Card, and a backup from TWRP which is of a size of 23.7 GB but does not have an obviously accessible structure.

Following the advice from another QA, it is possible to concatenate the data.ext4.win000 to data.ext4.win009 files and access them as a tar archive (It’s a good idea to cd to where you want the backup to be extracted to first):

bash cat | tar xvfi -

What this does is concatenate each file matching the pattern and then pipe the concatenated files to tar for
extraction. the – as the filename tells tar to extract from stdin. The
i option ignores zero blocks which will be in between each archive
file concatenated.

In this example I used the ext4 formatted data partition. Change
data.ext4 to match the partition you are extracting.

Although the tar command exits with

tar: Exiting with failure status due to previous errors

it extracts quite a few files before this hapens.

However, it is probably better to simply extract each of those files on their own without concatenating them, as in the comment by alecxs:

side note: concatenating win* files is wrong, that files are standalone tarball archives

Now that I have my /data directory again, I have access to /data/data/com.opera.browser and /data/app/com.opera.browser-2. What do I do with them to extract a list of urls that were open?

Directory Structures


│   ├───Application Cache
│   │   └───Cache
│   │       └───index-dir
│   ├───blob_storage
│   │   └───9b46839e-470e-4a3a-aa32-e9bc919a25f0
│   ├───databases
│   ├───databases-incognito
│   ├───File System
│   │   ├───026
│   │   │   └───t
│   │   │       └───Paths
│   │   └───Origins
│   ├───GCM Store
│   │   └───Encryption
│   ├───GPUCache
│   │   └───index-dir
│   ├───IndexedDB
│   │   ├───https_hackernoon.com_0.indexeddb.leveldb
│   │   ├───https_mobile.twitter.com_0.indexeddb.leveldb
│   │   ├───https_www.epicgames.com_0.indexeddb.leveldb
│   │   └───
│   ├───Local Storage
│   │   └───leveldb
│   ├───paks
│   ├───Platform Notifications
│   ├───saved_pages
│   ├───Service Worker
│   │   ├───CacheStorage
│   │   │   ├───5a6f7e336992bc24678958dc2f1f9b9eec83593b
│   │   │   │   ├───281ffb34-a074-4397-a60c-e3dc55aee5e5
│   │   │   │   │   └───index-dir
│   │   │   │   └───8d34090e-e00a-4f69-9450-bbe1b4b0dc9d
│   │   │   │       └───index-dir
│   │   │   ├───96f3041722d8f6857b95786ee88fa6a107a86943
│   │   │   │   └───11ccf6ea-9e2a-4648-8c61-a635e1cca5c5
│   │   │   │       └───index-dir
│   │   │   └───e60030e2e5440743857a39cacd108634434c91f1
│   │   │       ├───0045349f-4331-4037-bf9d-e9711e515a08
│   │   │       │   └───index-dir
│   │   │       ├───4a447cca-f7ca-41f1-9464-e40337cd7ed1
│   │   │       │   └───index-dir
│   │   │       └───907b2396-da18-4880-a0df-e3608abac640
│   │   │           └───index-dir
│   │   ├───Database
│   │   └───ScriptCache
│   │       └───index-dir
│   ├───Session Storage
│   ├───shared_proto_db
│   │   └───metadata
│   ├───Sync Data
│   │   └───LevelDB
│   └───VideoDecodeStats
│   ├───blob_storage
│   │   └───3f7cc261-4c0e-41cc-947b-2dc712733f49
│   ├───GPUCache
│   │   └───index-dir
│   └───Local Storage
│       └───leveldb
│   ├───cache
│   │   └───index-dir
│   ├───Crashpad
│   │   ├───attachments
│   │   ├───completed
│   │   ├───new
│   │   └───pending
│   ├───crash_dumps
│   ├───distiller
│   │   └───index-dir
│   └───okhttp
│   ├───AFRequestCache
│   ├───ds
│   │   ├───10
│   │   └───E
│   ├───images
│   │   └───share
│   ├───keychain
│   │   └───0
│   ├───reading
│   └───recently_closed_tabs


│   ├───arm
│   └───arm64


# 332 files of the nameformat "thumbnail_-214748????"
# 3   files of the nameformat "searchengine_j_<UUID>"

System Info

I think I was on Android 7.1.1
Rooted with Magisk, but stock ROM

Recently Closed Tabs

Not what I am looking for right now, but I stumbled upon the location of those, in case a future viewer is looking for them:


Related Links

Promising Files appstate.bin

data/data/com.opera.browser/files/appstate.bin contains at least some urls and their titles, separated by a null-byte. strings appstate.bin outputs more than just the urls that were open though. And some of those doubly or not completely.
I shall document my journy with this file below.

Looking at data/data/com.opera.browser/files/appstate.bin shows that it’s a binary data file, but it contains readable strings. Open it with vim appstate.bin or look at hexdump -C appstate.bin.

strings appstate.bin | grep -A3 reader_mode_state

already spits out quite a few urls. But it’s not yet obvious to me how the structure of that file actually works.

Some entries prefix the url with l or O or K or ) or not at all.
In some entries the first line after “reader_mode_state” is the url, in others it is “operaui://startpage” and the url follows further below.

But what stands out is that the urls all seem to start with http or https – unless you had some ftp or such open, which I’m pretty confident I did not.

strings appstate.bin | grep http

outputs 1506 lines though. some links are duplicates, others are links I do not care about. e.g. like so:


Since I don’t care about duplicates, we can apply uniq to reduce that number down to 967 urls. With sort -u we would get down to 833 instead. But both are still too many. It seems to me like opera also stores the tab’s history in there.

Removing some obviously unwanted lines gives 523 lines, so ~260 urls:

 strings appstate.bin | grep -v -e 'operaui://startpage' -e 'Speed Dial' | grep -A2 reader_mode_state | uniq | grep -v 'reader_mode_state'

As a target number to consider:

strings appstate.bin | grep reader_mode_state | wc -l

That means – assuming this target number is a good estimate of how many tabs were open – that I have about thirty urls too many. I think I can live with that.