HOW TO: iPhone Data Recovery

[new0rder]

I am using the DD from Forensic Acquisition Utilities too
no luck, got an Signal 127 error.
can anyone upload a working DD util?

update: 06/17
I finally got it working, I have run Ubuntu live cd on my pc, then everything work, took 5 hr to create my 16gb iphone 3g, after that everything is simple mount the img and run that photorec program, all my photos recovered.

Thank you all!

localhost:~ root# dd if=/dev/disk0 | ssh [email protected] 'dd of=k:/iphonedu
mp.img --localwrt'

                            ****USAGE WARNING****

This is a private computer system. This computer system, including all
related equipment, networks, and network devices (specifically including
Internet access) are provided only for authorized use. This computer system
may be monitored for all lawful purposes, including to ensure that its use
is authorized, for management of the system, to facilitate protection against
unauthorized access, and to verify security procedures, survivability, and
operational security. Monitoring includes active attacks by authorized entities
to test or verify the security of this system. During monitoring, information
may be examined, recorded, copied and used for authorized purposes. All
information, including personal information, placed or sent over this system
may be monitored.

Use of this computer system, authorized or unauthorized, constitutes consent
to monitoring of this system. Unauthorized use may subject you to criminal
prosecution. Evidence of unauthorized use collected during monitoring may be
used for administrative, criminal, or other adverse action. Use of this system
constitutes consent to monitoring for these purposes.


[email protected]'s password:
Signal 127
localhost:~ root# 

[seseberg]

Sergiu-3G:~ root# dd if=/dev/disk0 | ssh [email protected] 'dd of=/home/seseberg/iphone-dump.img'
[email protected]'s password:
dd: opening `/home/seseberg/iphone-dump.img': No such file or directory

what the h@ck am I doing wrong here? I am logged in as root, just installed ubuntu 9.10, and, that folder DOES exist in my /home/folder
what is going on? PLEASE HELP

you will need to ssh into the iphone using root user:

ssh root@IPADDRESSOFiPHONE

password should be: dottie

it's acsually alpine on +2.0 firmware. that is, of course, if you haven't passwd-ed your root account on your iphone.

where is the iphone-dump.img file being stored on the ubuntu machine by default if you dont enter your own folder? I cant seem to find it.

[shyam2666]

I have a iphone which bricked so I restore it from I tumes Phone version 2.2 jailbroken
If one can help me how to recover my SMS from Iphone
it will be great thanks, i need my SMS they have very important data
Plz help

[seseberg]

do you have any itunes backup folders of your iphone stuff?
you can use iphone backup extractor found at Reincubate: Labs: Backup Extractor for iPhone: extract and restore files from an iPhone backup on Windows, Linux and OS X
to get your sms database file from those backups that usually have long names like qowepruq093487ytd0378tyd0
so, if you DO have an itunes backup of your phone, YOUR OK!!!!
just DONT UNINSTALL ITUNES OR DELETE THAT FOLDER!!!!
once you get a hold of that file, you can manually put it back in /private/var/mobile/sms folder on your iphone, and, BOOM, your sms stuff is back........

[atomic hooligan]

Hi flager,
on the G5 (running Leopard), go into the system preferences > sharing and make sure "remote login" is ticked. It should also show you how to log in via ssh into that machine.
I would try now to log in from the phone to the G5. At the terminal on the phone type "ssh username@ipaddress". with no inverted commas and you G5 login username and ip address info of the G5. You will probably have to type "yes" to allow the ssh connection, however eventually it should log you in. Now type "exit" to log off of the G5 and try the command on the phone:
dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img'

you may need to be su user on the phone, just type su and the password alpine (I think...) to become su user on the phone.

good luck

Hello. Are you able to help. It would be greatly appreciated.

I've followed everything successfully (I think) and I've got as far as entering,

dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img'

I then gave the password requested which appears to have been accepted - there are no error messages. However, there appears to be no activity on the computer or iphone. Should i be able to see anything transferring at this point?

[atomic hooligan]

Right, I've found the iphone-dump.img in the 'Home' file.

Also, I've realised that you won't see any progress bar for the disk image transfer. To check it's progress, highlight the image and 'get info'. Each time you check, you should see a larger file size.

Another problem I encountered was that the phone's battery kept dying before the transfer was complete. Despite the phone being powered via USB or mains electricity, the amount of power needed to power the transfer is more than the amount the phone is being charged - but i worked that bit out!

I have a 16GB iPhone 3G. The phone's battery dies before I am able to transfer the entire disk image. During the transfer I noticed that the phone gets really hot on the back. I realised that electricity must be being lost as heat. So... I placed the phone on top of some frozen peas and after a very short time the phone began charging up again!

I eventually get a 15.12GB image of my iPhone hard drive

This is where I'm now stumped. I want to now mount this image and run a recovery software on that mounted drive.

My problem is that I can't mount the image. Under OSX, whether it be using Disk Utility, DiskImageMounter, Stuffit File Expander etc, I get the error "no mountable file systems". I get a similar error trying to use the mount command 'hdutil attach iphone-dump.img' in Terminal. I've done an exhaustive search on the internet searching for answers. I've found others having similar problems.

I wonder if anyone has any ideas to help out.

Thanks...

[baeretswil]

I am trying to recover dictaphone data (audio files) from Speakeasy.

I have got as far as being able to create the disk image on my mac - it is 6.23 G from a 16 G phone.

Is that plausible?

Now anyone got any ideas how I can try and get the CAF. Core Audio Files off the image?

Thanks

David

Thanks again Imarr28, I didn't realise that photorec could read directly the .img file. I have got nearly all my pictures back from a 16G iphone. It took awhile to download the image ( I left it going over night) but photorec did the restore very, very quickly...I'm impressed.
thanks again.

Hi Congratulations on getting your data

I just downloaded Photorec but I don't understand how to point it directly to the image. Do i have to install photorec as a unix command or something?

[permeke]

Hi flager ,
does this method also works for a jailbroken iphone with pictures from let's say a year ago. ?
I did since then several syncs, restores, and firmware updates with itunes.

thanks for your help.

eh, anyone ?


I'm asking this because, I dumped all photos on my powerbook, and then installed a new OS on that PB without making a backup , I know , I know , stupid me .

So my question is , can I recover either from the phone or from my "formatted" PB ?

thanks

[dl3r]

ok guys, I basically crashed my iphone and had to jailbreak it again, but I didn't have a back up of any of my contacts and now am in a heap of steaming, you know what. At any rate, I have openssh on the iphone with bigboss pref to activiate it, and then I have terminal loaded as well. I have winscp on my XP 32 bit machine and I can get into the iphone, but my iphone doesn't seem to want to talk back to the PC, hence I can't dump the memory onto the PC. Any help is greatly appreciated!

When I go into terminal on the iphone, I get
iPhone:~ mobile$
I then type in ssh [email protected] and then it says "ssh: connect to host 192.168.1.4 port 22: Operation timed out.
So basically I can do most of the steps except that it just won't dump the memory. Thanks for any help.

[dazz]

dl3r,

Try using this to get a ssh server service started on your XP box, then ssh into it. Worked for me.

MobaSSH - Free SSH server for Windows

.dazz

[dl3r]

will try it tonight and let you know . . . there was a great article about this, but they didn't go into enough detail to explain how it works. I'm really hoping this works! Thanks dazz.

Hey Dazz,
I loaded the program and tried to go to the help menu, but I don't understand how to set it up to be able to listen or send information? How do you set it up under XP and then what is the command under terminal on the iphone? I tried ssh ipaddress -1 administrator, which is what it said, but that didn't seem to work? Are there instructions on this site or another to help in setting that up? Any help is appreciated!

Here is a great article, but I can't figure out the step how to get into the iphone.
iPhone Forensics White Paper – Zdziarski technique – viaFORENSICS - viaFORENSICS

Any help is appreciated!

[bender o]

Hi, i can't get this to work (I'm running windows 7) I write everything and the i get this
sh: Felipe: No such file or directory

I've tried everything, using c/iphonedata/iphone- home/iphonedata/iphone- c/iphone-dump.img' but nothing works.
Please help me I need to recover some aiff files recorded with iTalk.
Thanks.

[dl3r]

This is what I did. I opened up SSH on my computer and logged in with the username and password. I went to my iphone and went to the terminal and then did the following:

iphone:/var/mobile root# (this is what displays)
I then type in SSH (username@ip_address) and it asks for a password. I put in my password, but the yellow cursor doesn't move when I put in my password. It then says permission denied, please try again. After failing I decide to try to ssh anyways and I type this:
su dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img' but then it says su: user dd does not exist and then it says [email protected]'s password: with a flashing yellow cursor.
I know I'm close, can anyone tell me what I'm missing? Thanks!
Dean

[paulcelie]

I followed the tuturial step by step, but every time i get the following error:

dd: reading /dev/disk0': invalid argument
0+0 records in
0_0 records out

I tried to find out if there were any problems with dd or ssh by entering the following line:

dd if=/dev/zero | ssh [email protected] 'dd of=dump.img'

This worked well, there was an image created called dump.img (of course without the data i needed), so I would say everything should work fine. But then the question, why do I still get that error?

I'm using a 32Gb 3GS iphone and Mac OS X leopard

[antnida]

Hello all,

I got stuck at ssh [email protected], keep getting a timed out error. Any hint to help me get pass this stage?

Installed openSSH and mobile terminal on my jailbbroken 3g and winCSP, putty and dd.exe on my Windows PC. I can ping my 3G no problem using my PC cmd command or putty, can also log into my 3G with winCSP and copy/transfer data to and from the 3G. Just can't get iphone to ping my PC successfully.

Thanks

[scroll1]

antnida, you need to use [email protected] to get into your iphone ( assuming your iphone's ip address is 192.168.1.102). Then use the password for root mentioned earlier

[Zuzizuz]

Hello guys, i was wondering if anyone could help me with this.

First of all, i'm a total newbie and don't really know what i'm doing :-), i just followed what i read on this great forum.

I had to restore my 3G, I managed to jailbreak it and unlock it (to my surpirse :-)) and now i've been trying to get some data back, that i never backed up :-(.

After 3 long evenings of learning and trying to dump the iphone's image file, I managed to start the dumping process, but it always stops at exactly 6,529,444 KB. Tried it 3 times and i get this error:

iPhone:~ root# 6686150656 bytes (6.7 GB) copied, 9504.19 s, 703 kB/s
-sh: syntax error near unexpected token `('
iPhone:~ root# Error reading file: 109 The pipe has been ended

I cant figure out what causes the dumping process to stop at exactly the same spot. Can anyone help me with this?? please?

Zuzana.

[Zuzizuz]

anyone? please.

[antnida]

I got through this part just fine, I can't moved on to the next though. Keep getting the timed out error.

antnida, you need to use [email protected] to get into your iphone ( assuming your iphone's ip address is 192.168.1.102). Then use the password for root mentioned earlier

Got stuck right here. Keep getting the timed out error. I did checked my router and allow port 22 to open as well as having WinCSP running.

Next, you'll want to make sure that you can SSH into your computer from the iPhone. To do that, open Terminal on the iPhone and enter:

ssh <username>@<computer-ip>

Where:
<username> = Your user name on the computer.
<computer-ip> = Your computer's IP address on the LAN.

If that worked, you should be prompted to enter a password for <username>. If the connection times out, then you need to make sure that you have the SSH server running on your computer and make sure that port 22 (the default SSH port) isn't being blocked by your router's firewall.

[0mie]

I need to recover ~600 baby pictures from my jailbroken 3.1 iPhone, but I seem to be missing BSD Subsystem and can't add any new sources. Is there anyway to get this to work? I'm probably missing something simple, but I REALLY need to get the pictures after iTunes said backup complete twice and I went to restore after my jailbreak and non of my data was there anymore

Any help? TIA