Can I recover images from a wiped iPhone?

---

@gmisura wrote:

My daughter got a hold of my phone (iPhone 5S, iOS 8.x) and proceeded to enter in my wife's password (because all phones use the same password, right?) and caused it to get wiped after entering in the wrong password enough times.

 

I'd really like to recover the images if possible.

 

No, there's no iTunes backup and no Photo Stream and no iCloud backup because we were at sea (on a cruise).

 

Can I use some software to get the filesystem off and try to find the images?

 

Thanks

---

If there are no backups, and the phone has been wiped, where to you propose the information be recovered from?  I hate to be the one to break teh bad news, but if you have not backuped up the device, and it has been wiped, it is wiped, and there's no getting the information back.

I have no idea if this works but I searched the internet and found this http://recoverdeletedphotosfromiphone.aolor.com/#method3

Geekboy,

In a regular "delete", the files are absolutely still there, just marked as "usable" and therefore can be overwritten. 

Depending on how the wipe is done, say a single format, the data is still there, but obviously much more difficult to recover. If multiple random bits are written, then the data is truly gone (at least for the money, if any, I'd be willing to spend to recover it).

As I've found online, the newer iPhones (I assume that includes my 5S) have hardware encryption and the keys are wiped along with the data so the likelihood of recovering anything seems extremely slim

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

"The metadata of all files in the file system is encrypted with a random key, which is created when iOS is first installed or when the device is wiped by a user."

" Erasing the key in this manner renders all files cryptographically inaccessible. "

I don't have a current iTunes backup, but I do have an old one. Would that contain the keys and therefore allow me to decrypt the data?

https://www.apple.com/br/ipad/business/docs/iOS_Security_Oct12.pdf

"Effaceable Storage: A dedicated area of NAND storage, used to store cryptographic keys, that can be addressed directly and wiped securely. While it doesn’t provide protection if an attacker has physical possession of a device, keys held in Effaceable Storage can be used as part of a key hierarchy to facilitate fast wipe and forward security"

I want to "hack" my phone!

if you do a restore all the data that may have been left will be gone as the keys are rewriten.

GLIMMERMAN76,

What source did you read that lead you to believe the restore process will cause the keys to be rewritten? The documents I sited indicated that the keys are only regenerated during a wipe and during initial setup.

I can see how if I were to do the restore, that would likely overwrite the images i'm trying to recover, thus making it very difficult/impossible to recover them.

My current hope is to:

1. Save the entire file system to a different location (use dd?)

2. Restore the phone from iTunes backup

3. Get the keys from the restored iPhone

4. Use the keys to extract the images from the file system from step #1

I realize this is very unrealistic.

with apple its not unrealistic its almost imposible.  That is why I have android devices and not apple.