iPhone 4S reset - a...
 
Notifications
Clear all

iPhone 4S reset - any chance?

7 Posts
5 Users
0 Likes
297 Views
newbietester
(@newbietester)
Posts: 2
New Member
Topic starter
 

Hi,

I am looking to see whether anyone has successfully retrieved data from an iPhone 4S which has been reset.

We do not have an associated pc/laptop or mac & do not have access to the itunes account.

I am aware that its virtually impossible due to the encryption key being deleted but I am wondering whether its possible once jailbroken.

Any advice or directions on where to go with this is much appreciated.

Thanks.

 
Posted : 15/01/2016 4:44 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

I recovered photos from several iPhones (4s and 5s). The photos were deleted.

 
Posted : 15/01/2016 6:08 pm
newbietester
(@newbietester)
Posts: 2
New Member
Topic starter
 

Hi Igor,

From an iPhone (4s +) that had been reset?

Regards

 
Posted : 15/01/2016 6:11 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

The photos were deleted manually.

 
Posted : 15/01/2016 6:42 pm
UnallocatedClusters
(@unallocatedclusters)
Posts: 570
Honorable Member
 

My understanding of iPhone factory resets is that Apple does NOT overwrite existing user data following a factory reset, but does overwrite the internal encryption key when a factory reset is performed.

Therefore, the user data still exists on the iPhone after a factory reset is performed, but the user data is no longer "viewable" because it is encrypted and the internal encryption key that would allow the user data to be viewed is now destroyed.

It was explained to me that Apple chose this route to preserve the lifetime usage of the internal memory storage, which would be adversely affected if the entire memory was overwritten each time a factory reset was performed.

So, I do not believe there is any reasonable method to recover evidence from a factory reset iPhone 4S due to the internal encryption key being destroyed upon a factory reset.

 
Posted : 15/01/2016 9:30 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

It was explained to me that Apple chose this route to preserve the lifetime usage of the internal memory storage, which would be adversely affected if the entire memory was overwritten each time a factory reset was performed.

Well, with all due respect for your source (and - just in case - for the source of your source) it is not like you do a factory reset every (say) wednesday and the battery will start to last nothing (or the user will crack the screen wink ) and/or the phone will be replaced by the new model much earlier than memory will wear out.
Without your information I would have bet that the reason of this choice was to make the reset procedure faster since the simple deleting of the encryption key has all in all the same effect

So, I do not believe there is any reasonable method to recover evidence from a factory reset iPhone 4S due to the internal encryption key being destroyed upon a factory reset.

as a complete wiping.

jaclaz

 
Posted : 15/01/2016 11:55 pm
RolfGutmann
(@rolfgutmann)
Posts: 1185
Noble Member
 

The reason of just destroying the key is to the 'Find my iPhone' function, if the device was lost/stolen to make sure the device gets wiped by just a short connectivity to iCoud (Activation Lock) service. Otherwise by turning of the device immediately the clean wiping would interrupt as the external physical on/off button could shut down the wiping unintensionably maybe. Only iOS updates downloaded to the iOS and checksummed normally block the UI and the screen.

 
Posted : 16/01/2016 12:19 am
Share:
Share to...