ipad A1337 jailbreaked , but no data recovery !!

could you give us more detail prh

could you give us more detail prh

If you create a DD image of say a 16 GB Ipad and outputted that on the same Ipad, any deleted data will have been over written by the 16 GB image file now stored on the Ipad.

Hopefully this was student project and not actual work |

Recommended reading – >>

"Jonathan Zdziarski - https://cryptome.org/isp-spy/iphone-spy4.pdf"
"https://www.safaribooksonline.com/library/view/iphone-forensics/9780596153588/ch04.html"

damn !! that's what i did ( anyway it's just a test
so thats mean all my steps are right except this dd if=/dev/rdisk0 bs=1M | dd of=ios-root.img
so ehat is the right command to write it from ssh session to local machine ?

i try to use testdisk to recover deleted files nothing restored !!

May be, it happened because files of the device are encrypted. wink

echo ios-root.img > /dev/null lol

I thought we were NOT on Reddit.

jaclaz

i try to use testdisk to recover deleted files nothing restored !!

May be, it happened because files of the device are encrypted. wink

how can i know if they encrypted or not ??

Open them in Hex Viewer.

Open them in Hex Viewer.

open what ?? the raw image ( .img ) ?

Open one of the files with known header. E.g. JPG file.

Open one of the files with known header. E.g. JPG file.

Well, since he recovered 0 files, that would be hard, but wouldn't anyway the header be also encrypted? ?

@qassam
Yes, the raw .img files.
Can you find the (HFS+) structures?
But more generally, if you just scroll a little bit, you will see if you can see readable text here and there or just a bunch of "random" hex values.

jaclaz