Extracting Readable...
 
Notifications
Clear all

Extracting Readable (deleted) data from iPhone backup file?

25 Posts
7 Users
0 Likes
1,656 Views
(@rottmom)
Posts: 12
Active Member
Topic starter
 

I'm trying to recover deleted messages in an unencrpted backup file.

I have opened it in a word .doc, .rtf, notepad++, TextEdit, and I can see a portion of the text, however when I open it in it's intended format of SQLite, the certain messages do not appear.

Notepad++ and TextEdit are new to me, so I don't really know how to change anything to make them readable.

Any help would be greatly appreciated.

 
Posted : 08/02/2011 2:19 am
(@allend)
Posts: 17
Active Member
 

What's the file header for the backup files?

 
Posted : 08/02/2011 2:23 am
(@rottmom)
Posts: 12
Active Member
Topic starter
 

It's the one that starts with 3d0d…… In the backup. Is that what you were asking?

Also, I'm using windows xp, the iPhone is a 3gs & it's running 4

 
Posted : 08/02/2011 2:28 am
(@rottmom)
Posts: 12
Active Member
Topic starter
 

I also have another question… While doing a search all files in textpad, I see files within the manifest that are named library/SMS/drafts/SMS- (then numbered) but I don't know what is in those (if anything?) they say plist, but when I open plist editor for windows, they do no show up. And you can't change "files of type" to anything other than .plist

 
Posted : 08/02/2011 3:01 am
(@douglasbrush)
Posts: 812
Prominent Member
 

Check out the goodness over at http//www.appleexaminer.com/ and http//insidethecore.com

There is a good walk through
http//www.appleexaminer.com/iPhoneiPad/iPhoneBackup/iPhoneBackup.html

And episode 5 of ITC (and really all of them as they dig into plists)

 
Posted : 08/02/2011 3:02 am
(@rottmom)
Posts: 12
Active Member
Topic starter
 

I have read and read and read (including the 2 links) and tried everything… For weeks… I'm sorry… I'm just to the point of utter confusion and can't figure out how to make this actually readable. I've never used anything like SQL or notepad++ or textpad or hexedit.

The ones that show up in sqlite are great, but I know there's more within the 3d0d file. It's just getting to it and making it readable.

 
Posted : 08/02/2011 3:23 am
(@mscotgrove)
Posts: 938
Prominent Member
 

Until you find the correct application, use a Hex editor/viewer.

At the same time, get used to hex dumps.

 
Posted : 08/02/2011 4:03 am
(@rottmom)
Posts: 12
Active Member
Topic starter
 

But in hex edit, I see the same amount of text as I do in a word .doc or .rtf etc… Just a portion of the actual message.

 
Posted : 08/02/2011 4:32 am
(@rottmom)
Posts: 12
Active Member
Topic starter
 

I'm so sorry for not understanding… This is all very new to me and I really appreciate y'all taking the time to help me.

This has been a HUGE learning experience!

 
Posted : 08/02/2011 4:38 am
(@rottmom)
Posts: 12
Active Member
Topic starter
 

Let me try to explain what I see… (I'm gonna make up numbers etc because I don't have the actual file open in front of me right now)

When I open up the file in hexedit, it looks like this on the left side

00 22 44 99 00 22
01 25 00 88 20 04

then on the right
….+2145551383€L U won't be disa…$c..+2146669982Â¥LOn my way babe. I'll see you in a little while.

So… The texts from 2145551383 have been deleted. 2146669983 have not been deleted. When opened up in SQLite, the messages from 214666 appear, but the 214555 do not.

There's so many jibberish characters in there and I don't know how to decipher them.

It's about the same thing when opened in textpad. (or in word .doc or .rtf) Obviously the hex numbers aren't there on the left side though. There seems to be a lot of ||| type characters in that one though.

In notepad++ there's a lot of darkened letters like NUL that appear between the texts.

Any idea how to translate this?

(When opened in sqlite, there's over 20,000 texts) but there's only 11 I'm trying to view.)

Thank you so much

 
Posted : 08/02/2011 6:52 am
Page 1 / 3
Share: