HELP! iPHONE XS MAX iOS 13
I guess it comes down to when the data was deleted and the amount if usage the device had post deletion. I would be interested to know what Apple changed in IOS 12/ 13 that suddenly made safari history and the likes unrecoverable unless looking at WAL records.
Understand by default the WAL checkpoints at 1000 pages but also have seen some articles stating it checkpoints when the app is swiped up or on device reboot.
MSAB won't solve your problem, as I wrote you earlier, GreyKey if LE or Cellebrite Advanced Services.
There are MSAB people on this forum, none will pretend they can unlock without data loss an iPhone XS Max running iOS 13!!!
@fissa: please stop bulk answering all the topics, mostly stop this behaviour if you have no idea what you are writing about!!!
The Elcomsoft blog is pretty accurate!
They don't say that the databases don't contain deleted data from the past, read again. After you got the sms.db and the -wal files available, that is when you can analyze the data and you will have or not what you are looking for.
You should also look for iCloud backups, if any, those can contain also data from the past, but only active content by then, not deleted stuff 🙂 If you have backups from the time when the SMS you are looking for was active, then you are lucky!
You should read this post from elcomsoft: https://blog.elcomsoft.com/2020/07/the-iphone-data-recovery-myth-what-you-can-and-cannot-recover/
If you dont try and investigate you will never know. One thing is for sure; You wont find anything usefull in un-allocated.
I cant imagine MSAB will offer there services, let you pay 2K, and wont deliver. If they wont, i bet there is a rule you receive back your 2K.
There is always the chance you will not find anything. Welcome to digital forensics 🙂