A couple of days ago I moved some camera roll photos to a new album then deleted the originals thinking they were duplicates. I now know different and have obviously lost them. Unfortunately they weren't backed up (they were holiday photos and this happened at the airport).
Commercial, newbie-orientated apps like Dr Wondershare aren't recovering them and I think I need to do a more low-level recovery. I stopped using the phone and switched it to airplane mode as soon as it happened. My first priority is to make an image of the data partition to (hopefully) avoid the data being overwritten. Any pointers on where to start?
NB. I've spent days Googling but keep coming across conflicting information when it comes to data recovery on iPhones. I have some experience of data recovery from Windows and Linux platforms.
Thanks for your time!
Problem is that the you can only do a logical on a 4s - and not a physical…
For those not familiar with what ForensicRanger is talking about–
A logical image only gets you the extant files, not deleted files. There is currently no commercially available method to acquire a physical image of an iPhone 4S or 5, so there is no way to recover deleted files from an iPhone 4S.
Those in law enforcement might be familiar with what Apple can recover given a proper warrant and several weeks, but I'm not sure you'll get all the deleted information even sending the phone to Apple.
You could take a sacrificial 4s apart, remove the baseband IC, find the JTAGs on it, trace it back to the non-volatile memory, attempt to read it, then decrypt the image…
Once you have that worked out, it is just repeat on the evidence. mrgreen It is cakewalk.
Do iPhones use TRIM/Garbage collection (or equivalent).
If so, the deleted files will now be zeros spaces in the memory.
You could do a file system extraction on the 4s, possibly recovering data which has been flagged for deletion( ie no longer accessible to the user) but not yet deleted in the biblical sense
UFED will do file system extraction on 4s and 5 (5 covered for CDMA as well )
Do iPhones use TRIM/Garbage collection (or equivalent).
If so, the deleted files will now be zeros spaces in the memory.
The 4S uses Samsung K9PFG08U5M MLC NAND flash memory in a TLGA package type.
It is a willy beast of eight stacked dies in a single package for 32GB.
I am not aware of such "garbage collection" in flash memory which would "zeros spaces" in memory. It would exponentially decrease the use of flash memory, as it would wear the device out with the additional writes.
This is why "wear leveling" is in use - to reduce the writes on cells.
It is possible that the controller may present certain blocks or pages as containing zeroes, but I have not ran into such scenario.
Even remapping of failing pages to unused pages, would present the original data, not "zeros spaces".
I presume when you write "zeros spaces" you mean "zeros" as hexadecimal value, and "spaces" as they appear visually. After all, spaces are not zeros in hex, nor are zeros in hex are spaces.
If you just don't have any backup to restore, you may need to use an
