$ fastboot oem unlock The procedure must be confirmed on-screen, and deletes the user data for privacy reasons. It only needs to be run once.
$ fastboot boot recovery-clockwork-220.127.116.11-grouper.img downloading 'boot.img'... FAILED (remote: Bootloader is locked.) finished. total time: 0.020s $ fastboot oem unlock ... (bootloader) erasing userdata... (bootloader) erasing userdata done (bootloader) erasing cache... (bootloader) erasing cache done (bootloader) unlocking... (bootloader) Bootloader is unlocked now. OKAY [ 12.704s] finished. total time: 12.704s $ fastboot flash recovery recovery-clockwork-18.104.22.168-grouper.img sending 'recovery' (6480 KB)... OKAY [ 0.785s] writing 'recovery'... OKAY [ 0.225s] finished. total time: 1.010s # after that boot into the recovery (don't boot normal! it overwrites valuable data...) $ adb shell cat /dev/block/platform/sdhci-tegra.3/by-name/UDA \| gzip -1 -c \| uuencode bla | uudecode -o - | gunzip -dc | bar > /media/qnap/backup/n7.data.forma