Notifications
Clear all

Wiped iPads

5 Posts
3 Users
0 Likes
255 Views
jblakley
(@jblakley)
Posts: 110
Estimable Member
Topic starter
 

Does anyone know of a product that can recover data from wiped ipads? Guidance pointed me to Blackbag, and I'm waiting for a trial version from them. I'm not sure if anything can be done if the device was wiped though…

Thanks!
John

 
Posted : 03/02/2016 5:44 pm
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

Blackbag is the best address. They are ex Apple guys. iOS devices just destroy the key but not actively overwrite the data. Think about 'Find my iPhone' app - by destroying the key and locking the device over the 'Activation Lock Service' at Apple. Lost/stolen devices can be wiped and protected from new use.

 
Posted : 03/02/2016 9:23 pm
jblakley
(@jblakley)
Posts: 110
Estimable Member
Topic starter
 

Thanks! I'm still waiting on them to respond from an email a couple of days ago. I may just break down and give them a call tomorrow…

 
Posted : 04/02/2016 8:13 am
(@mark_adp)
Posts: 63
Trusted Member
 

From my understanding, if the device has been wiped, the data does still exist, but is encrypted. The key's to decrypt the data are wiped as part of the wiping process.

The nature of flash memory means that typically, when something is marked for deletion, the pointers are updated to point to a different part of the disk, this makes it seem, from the OS perspective that the data is gone, but actually the original data is still there, the pointers are just not pointing to it anymore. This would (typically) mean that if encryption keys in flash were "deleted" they could be recovered by looking at the previous location in physical memory, HOWEVER! Apple are clever clogs and partition a portion of their flash as "effaceable area", meaning this area of memory does not behave in the same way as the other areas, and when something is deleted, it is actually overwritten in place.

If you find any more info, please update us.

Is there any chance you can recover a backup? cloud/computer?

 
Posted : 04/02/2016 10:43 am
jblakley
(@jblakley)
Posts: 110
Estimable Member
Topic starter
 

I found out yesterday that it's not part of our normal process to wipe ipads. Normally what happens is when a user leaves the company, the ipad is remotely wiped to be reallocated. The ipads are mdm managed and the option is grayed out for the user to do this manually. Also, since it's mdm managed, I can't connect it to any computer to do a backup for analysis. The people in charge of mdm have assured me that they will not wipe an ipad next time and will remove it from mdm management so I'll be able to make a backup and at least get it into encase before they wipe it.

Thank you for all of the responses!
John

 
Posted : 04/02/2016 5:26 pm
Share: