How to recover deleted images from any iOS device

It is good article. Thanks.

Hello everybody!

I've written a small article on deleted images recovery from iOS devices.

Hope you enjoy it

http//www.weare4n6.com/how-to-recover-deleted-images-from-any-ios-device/

P.S. Your feedback is highly appreciated!

Does the MD5 of the deleted image match the one of the one in the thumbnail?

You seem to be saying that this only works on an iTunes backup. Does this mean you need to have access to the suspect's computer and they must have made a backup around the time of deleting the photos?

Or are you saying you can subsequently make an iTunes backup yourself of the i device and any and all deleted photos will be recoverable using this method in the sqlite?

To Deltron

Thanks for your reply!

It does not. Because it's not the origibal image, it's just its thumbnail, but usually the size of it is big enough to see the picture clear.

To wotsits

Thanks for your question!

No, you don't need to have access to the suspect's computer. And yes, you can perform an iTunes backup acqusition yourself, or any type of data extraction available, export iThmb files and then use them for exporting deleted images' thumbnails (if there are any).

Figure 1. The .ithmb files located under CameraRollDomain\Media\PhotoData\Thumbnails shows the modified dates/times for the images as approx. three to six months prior to the creation and access dates/times. Is iTHM or iTHMconvertor generating those dates/times?

trewmte, thanks for your reply!

Here I used logical extraction method via Magnet Aquire (an iTunes backup plus some more data), I think, C and A timestamps were modified during the backup process, so these stamps are times the files were copied to my workstation's drive.