Available Now: Buy the new iPhone 14, iPhone 14 Pro and iPhone 14 Pro Max from AT&T!
Get the myAT&T app
gmisura's profile

Tutor

 • 

4 Messages

Wed, Mar 25, 2015 1:03 AM

Can I recover images from a wiped iPhone?

My daughter got a hold of my phone (iPhone 5S, iOS 8.x) and proceeded to enter in my wife's password (because all phones use the same password, right?) and caused it to get wiped after entering in the wrong password enough times.

 

I'd really like to recover the images if possible.

 

No, there's no iTunes backup and no Photo Stream and no iCloud backup because we were at sea (on a cruise).

 

Can I use some software to get the filesystem off and try to find the images?

 

Thanks

GeekBoy

Master

 • 

4.1K Messages

8 y مضت


@gmisura wrote:

My daughter got a hold of my phone (iPhone 5S, iOS 8.x) and proceeded to enter in my wife's password (because all phones use the same password, right?) and caused it to get wiped after entering in the wrong password enough times.

 

I'd really like to recover the images if possible.

 

No, there's no iTunes backup and no Photo Stream and no iCloud backup because we were at sea (on a cruise).

 

Can I use some software to get the filesystem off and try to find the images?

 

Thanks


If there are no backups, and the phone has been wiped, where to you propose the information be recovered from?  I hate to be the one to break teh bad news, but if you have not backuped up the device, and it has been wiped, it is wiped, and there's no getting the information back.

Anonymous

New Member

 • 

25.7K Messages

8 y مضت

I have no idea if this works but I searched the internet and found this http://recoverdeletedphotosfromiphone.aolor.com/#method3

Tutor

 • 

4 Messages

8 y مضت

Geekboy,

 

In a regular "delete", the files are absolutely still there, just marked as "usable" and therefore can be overwritten. 

 

Depending on how the wipe is done, say a single format, the data is still there, but obviously much more difficult to recover. If multiple random bits are written, then the data is truly gone (at least for the money, if any, I'd be willing to spend to recover it).

 

As I've found online, the newer iPhones (I assume that includes my 5S) have hardware encryption and the keys are wiped along with the data so the likelihood of recovering anything seems extremely slim

 

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

"The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first installed or when the device is wiped by a user."

 

" Erasing the key in this manner renders all files cryptographically inaccessible. "

 

I don't have a current iTunes backup, but I do have an old one. Would that contain the keys and therefore allow me to decrypt the data?

 

https://www.apple.com/br/ipad/business/docs/iOS_Security_Oct12.pdf

 

"Effaceable Storage: A dedicated area of NAND storage, used to store cryptographic keys, that can be addressed directly and wiped securely. While it doesn’t provide protection if an attacker has physical possession of a device, keys held in Effaceable Storage can be used as part of a key hierarchy to facilitate fast wipe and forward security"

 

I want to "hack" my phone!

GLIMMERMAN76

ACE - Expert

 • 

23.4K Messages

8 y مضت

if you do a restore all the data that may have been left will be gone as the keys are rewriten.

Tutor

 • 

4 Messages

8 y مضت

GLIMMERMAN76,

 

What source did you read that lead you to believe the restore process will cause the keys to be rewritten? The documents I sited indicated that the keys are only regenerated during a wipe and during initial setup.

 

I can see how if I were to do the restore, that would likely overwrite the images i'm trying to recover, thus making it very difficult/impossible to recover them.

 

My current hope is to:

 

1. Save the entire file system to a different location (use dd?)

2. Restore the phone from iTunes backup

3. Get the keys from the restored iPhone

4. Use the keys to extract the images from the file system from step #1

 

I realize this is very unrealistic.

GLIMMERMAN76

ACE - Expert

 • 

23.4K Messages

8 y مضت

with apple its not unrealistic its almost imposible.  That is why I have android devices and not apple. 

Tutor

 • 

4 Messages

8 y مضت

After chatting with Apple support via their website, I remembered that I also was forced to change my password. That likely changed the keys, so even if I were somehow able to copy the file system off of the phone and retrieve the keys from the backup in iTunes, I wouldn't be able to decrypt the file system as the keys would be different.

 

I gave up.

Need help?
Fix, replace or check device delivery
New to AT&T Community?
New to the AT&T Community? Start by visiting the Community How-To.
New to the AT&T Community?
Visit the Community How-To.