±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 34081
New Yesterday: 0 Visitors: 136

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

iPhone 4 + iOS 6

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

iPhone 4 + iOS 6

Post Posted: Thu Oct 25, 2012 11:39 am

Hey All,

Firstly, let me say hi, and thanks for having me on this forum.

Secondly, a bit of background information. A colleague of mine has had her kids update her phone to iOS 6. Subsequently all the photos of her kids have gone. Her partner tried to restore from backup and used Dr Fone from wondershare to try recover her photos, however this did not work.

The phone does not have a pin and also, unfortunately she does not have any backups. Confused

So, I have a little experience with PhotoRec & dd etc so offered to see if I could recover the photos (well, the ones that haven't been overwritten anyway). I have recovered information for some other colleagues (and my own) laptops and external hard drives after failures and accidental formats.

Thus far, I have successfully jailbroken and established an SSH connection to the phone and from the phone to my Linux box

However when I try to dd the drives 2nd partition, I get dd: opening `/dev/disk0s1s2': Resource busy.

Also, I have tried to un-mount the drive so that I can dd it and as soon as I have unmounted it the phones screen starts wheeling until my SSH session closes and the phone restarts.

Finally, my question, is there anyone here who would be able to point me in the right direction? Or even better tell me how I can successfully un-mount the drive/load into a hacked dfu mode to allow me to dd the drive without the resource busy error?. Any help would be appreciated! Essentially I would like to parse over the disk with photorec and recover what I can or confidently tell her that her photos are long-gone (although this is looking more and more likely).

Thanks & Regards


Re: iPhone 4 + iOS 6

Post Posted: Fri Nov 23, 2012 10:29 am

Is it just the photos of her kids that have gone? Or is that all she is bothered about getting back?

When I updated an iPhone 4 to iOS6 and also iPhone 5 to iOS6 the devices ended up being wiped clean, new OS installed and then my data was restored from the previous backups. This sounds like it may be what happened to her device.

The issue here is that if the device reinstalled a new OS rather than updating the previous there is a good chance that the encryption keys for the old OS were dumped during the process and new ones generated upon installation of the updated OS.

If this is the case, unfortunately that means that you will not have any luck recovering any of the data which has been lost. Sad

Colin Mortimer

Senior Member

Re: iPhone 4 + iOS 6

Post Posted: Wed Dec 26, 2012 4:35 am

Yes Colin. You are right. When iOS gets updated, it generates new set of encryption keys. So there is no way to recover previous data.  


Re: iPhone 4 + iOS 6

Post Posted: Thu Dec 27, 2012 3:58 pm

Has your friend resynchronized with photo stream? If they had it on previously there may be some backed up photos there?

May they have at some point charged their phone in another persons laptop or tower to charge? If so there computer may have made a backup without them even realsing  

Senior Member

Page 1 of 1