HELP! iPhone 5 - iO...
 
Notifications
Clear all

HELP! iPhone 5 - iOS 7

17 Posts
8 Users
0 Likes
679 Views
(@t2014)
Posts: 5
Active Member
Topic starter
 

Need to recover text messages that were deleted before syncing iPhone and updating to iOS 7.

All I have is backup made after updating to iOS 7.

What options are there?

 
Posted : 16/02/2014 4:12 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

If you do not want to get help ( http//www.forensicfocus.com/Forums/viewtopic/t=11469/ ), use Oxygen Forensic Suite. It costs ~4000$. ( but it (Oxygen Forensic Suite) is the best.

 
Posted : 16/02/2014 11:52 am
MagnetForensics
(@magnetforensics)
Posts: 40
Eminent Member
 

Hi T2014,

It's always nice to have multiple options especially when it comes to mobile forensics; Oxygen is worth trying as Igor mentioned and we can also help if you have IEF Advanced. I'd be happy to provide a free trial if you're interested, just email me at jad(at)magnetforensics(dot)com.

Good luck either way!
Jad

 
Posted : 16/02/2014 8:00 pm
bigjon
(@bigjon)
Posts: 159
Estimable Member
 

t2014,
I am sure you are aware, when you delete from your iphone this just removes the header.
when you then sync , your computer takes everything from your phone into the computer, minus anything which has no header (comp presumes you do not want the content of this therefore ignoring it,) once you have then reset your iphone to factory settings all data is " cleared" and you have a new-ish phone again, however there is still data in the unallocated space, this may / may not contain your text, it depends when you deleted this and how much you have used the phone ( and deleted numerous texts ) before syncing, there are tools which can recover such data but there is no guarantee it will contain this specific text

 
Posted : 16/02/2014 8:59 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

t2014,
I am sure you are aware, when you delete from your iphone this just removes the header.
when you then sync , your computer takes everything from your phone into the computer, minus anything which has no header (comp presumes you do not want the content of this therefore ignoring it,) once you have then reset your iphone to factory settings all data is " cleared" and you have a new-ish phone again, however there is still data in the unallocated space, this may / may not contain your text, it depends when you deleted this and how much you have used the phone ( and deleted numerous texts ) before syncing, there are tools which can recover such data but there is no guarantee it will contain this specific text

It is not true (if I understand you correctly)

I tested some iPhones (from iPhone 2 to iPhone 4) after updated them firmware. I didn't find old information (pictures, movies, calls, text messages etc.).

 
Posted : 16/02/2014 9:05 pm
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

use Oxygen Forensic Suit. It costs ~4000$. ( but it is the best.

I think it would be more accurate to say Oxygen is the cheapest 😉

In my opinion XRY and UFED both far outstrip Oxygen, but not affordable for everyone I suppose.

 
Posted : 17/02/2014 8:56 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

I said that Oxygen Forensic Suite is the best tool for decode iTunes backup.

You are right. Oxygen Forensic Suite is the cheapest.

 
Posted : 17/02/2014 9:27 am
(@dcs1094)
Posts: 146
Estimable Member
 

Just to confirm, you do not have any previous backups from the device stored in the default storage location on the host computer? There may be a number of backups inside the main backup folder.
Assuming Windows 7 \Users\<username>\AppData\Roaming\AppleComputer\MobileSync\Backup\

Apple devices use SQLite databases to store their information inside them. SMS messages are located inside the sms.db file which needs to be extracted from the device. When an entry is deleted, the entry is 'flagged' as deleted, but information still resides inside the db file until that space is needed to write new data to it. As you only have a backup after the message was deleted, there is a good chance you may not find any deleted information left.

There are tools on the market for exactly this, but your best bet is to use the tools mentioned by the other guys to attempt to recover any SMS artifacts that are left inside the records. Obviously they can cost a lot, however they all do a great job!

Good luck 8)

 
Posted : 17/02/2014 2:49 pm
(@t2014)
Posts: 5
Active Member
Topic starter
 

There is one backup from a year before which won't do me any good as that loses a years worth of information.

This is just a mess. sms.db text file doenst have anything either. all deleted texts are gone. I can't believe that the firmware update was able to erase all this data.

Even if overwritten I feel as if there is always someway to drag data to the surface.

 
Posted : 18/02/2014 11:46 pm
(@dcs1094)
Posts: 146
Estimable Member
 

The sms.db file will not simply just display the deleted messages if viewed through an SQLite browser, as the reference for the specific sms messages are removed once deleted.

Realistically speaking your only option is to use the tools already mentioned to try and recover sms message artifacts from the SQLite db file. If no records are recovered, the chances are that the messages have since been overwritten. *Not specially for iPhone's, however there are certain devices that once an entry is deleted and the phone then connected to the host computer, the deleted flagged items are removed.

You could take a look at this, however i don't think it'll do you much good because of the firmware update… http//www.zdziarski.com/blog/?p=1236

 
Posted : 19/02/2014 12:11 am
Page 1 / 2
Share: