±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 3
New Yesterday: 8
Overall: 26811
Visitors: 62

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

iPhone 4 + iOS 6

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

iPhone 4 + iOS 6

Post Posted: Thu Oct 25, 2012 6:39 am

Hey All,

Firstly, let me say hi, and thanks for having me on this forum.

Secondly, a bit of background information. A colleague of mine has had her kids update her phone to iOS 6. Subsequently all the photos of her kids have gone. Her partner tried to restore from backup and used Dr Fone from wondershare to try recover her photos, however this did not work.

The phone does not have a pin and also, unfortunately she does not have any backups. Confused

So, I have a little experience with PhotoRec & dd etc so offered to see if I could recover the photos (well, the ones that haven't been overwritten anyway). I have recovered information for some other colleagues (and my own) laptops and external hard drives after failures and accidental formats.

Thus far, I have successfully jailbroken and established an SSH connection to the phone and from the phone to my Linux box

However when I try to dd the drives 2nd partition, I get dd: opening `/dev/disk0s1s2': Resource busy.

Also, I have tried to un-mount the drive so that I can dd it and as soon as I have unmounted it the phones screen starts wheeling until my SSH session closes and the phone restarts.

Finally, my question, is there anyone here who would be able to point me in the right direction? Or even better tell me how I can successfully un-mount the drive/load into a hacked dfu mode to allow me to dd the drive without the resource busy error?. Any help would be appreciated! Essentially I would like to parse over the disk with photorec and recover what I can or confidently tell her that her photos are long-gone (although this is looking more and more likely).

Thanks & Regards
Red4ctd  

red4ctd
Newbie
 
 
  

Re: iPhone 4 + iOS 6

Post Posted: Fri Nov 23, 2012 5:29 am

Is it just the photos of her kids that have gone? Or is that all she is bothered about getting back?

When I updated an iPhone 4 to iOS6 and also iPhone 5 to iOS6 the devices ended up being wiped clean, new OS installed and then my data was restored from the previous backups. This sounds like it may be what happened to her device.

The issue here is that if the device reinstalled a new OS rather than updating the previous there is a good chance that the encryption keys for the old OS were dumped during the process and new ones generated upon installation of the updated OS.

If this is the case, unfortunately that means that you will not have any luck recovering any of the data which has been lost. Sad

Colin
_________________
Colin Mortimer
AirWatch 

Coligulus
Senior Member
 
 
  

Re: iPhone 4 + iOS 6

Post Posted: Tue Dec 25, 2012 11:35 pm

Yes Colin. You are right. When iOS gets updated, it generates new set of encryption keys. So there is no way to recover previous data.  

satishb3
Newbie
 
 
  

Re: iPhone 4 + iOS 6

Post Posted: Thu Dec 27, 2012 10:58 am

Has your friend resynchronized with photo stream? If they had it on previously there may be some backed up photos there?

May they have at some point charged their phone in another persons laptop or tower to charge? If so there computer may have made a backup without them even realsing  

mobileforensicswales
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1