Notifications
Clear all

iPhone 4 + iOS 6

4 Posts
4 Users
0 Likes
417 Views
(@red4ctd)
Posts: 1
New Member
Topic starter
 

Hey All,

Firstly, let me say hi, and thanks for having me on this forum.

Secondly, a bit of background information. A colleague of mine has had her kids update her phone to iOS 6. Subsequently all the photos of her kids have gone. Her partner tried to restore from backup and used Dr Fone from wondershare to try recover her photos, however this did not work.

The phone does not have a pin and also, unfortunately she does not have any backups. ?

So, I have a little experience with PhotoRec & dd etc so offered to see if I could recover the photos (well, the ones that haven't been overwritten anyway). I have recovered information for some other colleagues (and my own) laptops and external hard drives after failures and accidental formats.

Thus far, I have successfully jailbroken and established an SSH connection to the phone and from the phone to my Linux box

However when I try to dd the drives 2nd partition, I get dd opening `/dev/disk0s1s2' Resource busy.

Also, I have tried to un-mount the drive so that I can dd it and as soon as I have unmounted it the phones screen starts wheeling until my SSH session closes and the phone restarts.

Finally, my question, is there anyone here who would be able to point me in the right direction? Or even better tell me how I can successfully un-mount the drive/load into a hacked dfu mode to allow me to dd the drive without the resource busy error?. Any help would be appreciated! Essentially I would like to parse over the disk with photorec and recover what I can or confidently tell her that her photos are long-gone (although this is looking more and more likely).

Thanks & Regards
Red4ctd

 
Posted : 25/10/2012 5:39 pm
(@coligulus)
Posts: 165
Estimable Member
 

Is it just the photos of her kids that have gone? Or is that all she is bothered about getting back?

When I updated an iPhone 4 to iOS6 and also iPhone 5 to iOS6 the devices ended up being wiped clean, new OS installed and then my data was restored from the previous backups. This sounds like it may be what happened to her device.

The issue here is that if the device reinstalled a new OS rather than updating the previous there is a good chance that the encryption keys for the old OS were dumped during the process and new ones generated upon installation of the updated OS.

If this is the case, unfortunately that means that you will not have any luck recovering any of the data which has been lost. (

Colin

 
Posted : 23/11/2012 3:29 pm
(@satishb3)
Posts: 6
Active Member
 

Yes Colin. You are right. When iOS gets updated, it generates new set of encryption keys. So there is no way to recover previous data.

 
Posted : 26/12/2012 9:35 am
(@mobileforensicswales)
Posts: 274
Reputable Member
 

Has your friend resynchronized with photo stream? If they had it on previously there may be some backed up photos there?

May they have at some point charged their phone in another persons laptop or tower to charge? If so there computer may have made a backup without them even realsing

 
Posted : 27/12/2012 8:58 pm
Share: