iPhone 4S iOS 6 Dat...
 
Notifications
Clear all

iPhone 4S iOS 6 Data Recovery

8 Posts
7 Users
0 Likes
424 Views
(@noisey)
Posts: 1
New Member
Topic starter
 

A couple of days ago I moved some camera roll photos to a new album then deleted the originals thinking they were duplicates. I now know different and have obviously lost them. Unfortunately they weren't backed up (they were holiday photos and this happened at the airport).

Commercial, newbie-orientated apps like Dr Wondershare aren't recovering them and I think I need to do a more low-level recovery. I stopped using the phone and switched it to airplane mode as soon as it happened. My first priority is to make an image of the data partition to (hopefully) avoid the data being overwritten. Any pointers on where to start?

NB. I've spent days Googling but keep coming across conflicting information when it comes to data recovery on iPhones. I have some experience of data recovery from Windows and Linux platforms.

Thanks for your time!

 
Posted : 21/08/2013 5:52 pm
ForensicRanger
(@forensicranger)
Posts: 122
Estimable Member
 

Problem is that the you can only do a logical on a 4s - and not a physical…

 
Posted : 26/08/2013 6:31 pm
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
 

For those not familiar with what ForensicRanger is talking about–
A logical image only gets you the extant files, not deleted files. There is currently no commercially available method to acquire a physical image of an iPhone 4S or 5, so there is no way to recover deleted files from an iPhone 4S.

Those in law enforcement might be familiar with what Apple can recover given a proper warrant and several weeks, but I'm not sure you'll get all the deleted information even sending the phone to Apple.

 
Posted : 26/08/2013 9:24 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

You could take a sacrificial 4s apart, remove the baseband IC, find the JTAGs on it, trace it back to the non-volatile memory, attempt to read it, then decrypt the image…

Once you have that worked out, it is just repeat on the evidence. mrgreen It is cakewalk.

 
Posted : 26/08/2013 10:46 pm
(@mscotgrove)
Posts: 938
Prominent Member
 

Do iPhones use TRIM/Garbage collection (or equivalent).

If so, the deleted files will now be zeros spaces in the memory.

 
Posted : 27/08/2013 1:57 am
bigjon
(@bigjon)
Posts: 159
Estimable Member
 

You could do a file system extraction on the 4s, possibly recovering data which has been flagged for deletion( ie no longer accessible to the user) but not yet deleted in the biblical sense

UFED will do file system extraction on 4s and 5 (5 covered for CDMA as well )

 
Posted : 28/08/2013 2:36 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

Do iPhones use TRIM/Garbage collection (or equivalent).

If so, the deleted files will now be zeros spaces in the memory.

The 4S uses Samsung K9PFG08U5M MLC NAND flash memory in a TLGA package type.

It is a willy beast of eight stacked dies in a single package for 32GB.

I am not aware of such "garbage collection" in flash memory which would "zeros spaces" in memory. It would exponentially decrease the use of flash memory, as it would wear the device out with the additional writes.

This is why "wear leveling" is in use - to reduce the writes on cells.

It is possible that the controller may present certain blocks or pages as containing zeroes, but I have not ran into such scenario.

Even remapping of failing pages to unused pages, would present the original data, not "zeros spaces".

I presume when you write "zeros spaces" you mean "zeros" as hexadecimal value, and "spaces" as they appear visually. After all, spaces are not zeros in hex, nor are zeros in hex are spaces.

 
Posted : 28/08/2013 9:17 pm
(@Anonymous)
Posts: 0
Guest
 

If you just don't have any backup to restore, you may need to use an iPhone backup extractor software to recover iOS data on Recovery-Tool.

 
Posted : 09/07/2014 9:55 am
Share: