Sunday, January 29, 2012

iPhone - Links about Recovering Images (I Didn't Get Them Yet)

In case you hit this link to see explicit steps about recovering images from an iPhone I haven't actually done it yet. My mom deleted some images without actually backing them up, and, asked me to look into recovering them.  No one had done a jailbreak on her phone yet, so, it was a non-issue, and, I ran out of time to work on it over the weekend.  Nonetheless, I compiled a list of links to revisit if it comes up again.  From what I read, there are three main steps: Here they are:

If I get around to actually doing this I'll be sure to document my process.  The main thing I am trying to do is recover deleted images.  I haven't found the exact technical details of this process yet.  Since I have a strong interest in forensics (and a little real experience) it shouldn't be too unfamiliar. The environment, at this point, is the biggest thing I need to figure out since I'm really a Windows guy with a very old Mac history (read that to mean the early 90's laptops...really).

There were a bunch of tools that must have used an exposed API Windows could access.  Via a variety of tools I was able to see a standard list of files, but, even when I tried to access the device via Access Data FTK Imager, I couldn't get the application to recognize the drive, either as physical or logical drive.  So, whatever driver iPhone uses to mount to Windows for browsing does not get recognized as a regular drive in Windows.  This is hardly surprising, so, I am still looking for ways to get this done without doing a jailbreak.  When my mom spoke with Apple they said there is a service in California that recovers images for $900 to $1200.  That suggests to me there is a way to do it, but, you more than likely have to be "in the know" with regards to iPhone software.  Since the most technical thing I know about the iPhone is that I have one digging deeply into trying to reverse engineer whatever this company may be doing seemed like a waste of time.  I told my mom to hire some kid getting a master's in forensics from the local university, but, she didn't feel like going that route.  More details to come...more than likely.

2 comments:

  1. $900 to $1200 for recovering deleted images from an iphone??? what a rip-off!!!

    ReplyDelete
  2. Yeah, it seemed a little steep to me too. I figured I could drop $50 on a brand new iPhone forensics book and get a seat for some decent software for $250 and still do the same thing myself. I just don't know the steps... If I find a good book (I have one mind) I'll share what I used to get it going.

    ReplyDelete