Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.
Thread: HOW TO: iPhone Data Recovery
06-15-2009, 09:39 PM #41
I am using the DD from Forensic Acquisition Utilities too
no luck, got an Signal 127 error.
can anyone upload a working DD util?
I finally got it working, I have run Ubuntu live cd on my pc, then everything work, took 5 hr to create my 16gb iphone 3g, after that everything is simple mount the img and run that photorec program, all my photos recovered.
Thank you all!
localhost:~ root# dd if=/dev/disk0 | ssh [email protected] 'dd of=k:/iphonedu
This is a private computer system. This computer system, including all
related equipment, networks, and network devices (specifically including
Internet access) are provided only for authorized use. This computer system
may be monitored for all lawful purposes, including to ensure that its use
is authorized, for management of the system, to facilitate protection against
unauthorized access, and to verify security procedures, survivability, and
operational security. Monitoring includes active attacks by authorized entities
to test or verify the security of this system. During monitoring, information
may be examined, recorded, copied and used for authorized purposes. All
information, including personal information, placed or sent over this system
may be monitored.
Use of this computer system, authorized or unauthorized, constitutes consent
to monitoring of this system. Unauthorized use may subject you to criminal
prosecution. Evidence of unauthorized use collected during monitoring may be
used for administrative, criminal, or other adverse action. Use of this system
constitutes consent to monitoring for these purposes.
[email protected]'s password:
Last edited by new0rder; 06-17-2009 at 10:25 AM.
06-20-2009, 12:37 PM #42
Sergiu-3G:~ root# dd if=/dev/disk0 | ssh [email protected] 'dd of=/home/seseberg/iphone-dump.img'
[email protected]'s password:
dd: opening `/home/seseberg/iphone-dump.img': No such file or directory
what the [email protected] am I doing wrong here? I am logged in as root, just installed ubuntu 9.10, and, that folder DOES exist in my /home/folder
what is going on? PLEASE HELP
where is the iphone-dump.img file being stored on the ubuntu machine by default if you dont enter your own folder? I cant seem to find it.
Last edited by seseberg; 06-20-2009 at 12:37 PM. Reason: Automerged Doublepost
06-24-2009, 09:27 PM #43sms recovery
I have a iphone which bricked so I restore it from I tumes Phone version 2.2 jailbroken
If one can help me how to recover my SMS from Iphone
it will be great thanks, i need my SMS they have very important data
06-26-2009, 08:47 AM #44
do you have any itunes backup folders of your iphone stuff?
you can use iphone backup extractor found at Reincubate: Labs: Backup Extractor for iPhone: extract and restore files from an iPhone backup on Windows, Linux and OS X
to get your sms database file from those backups that usually have long names like qowepruq093487ytd0378tyd0
so, if you DO have an itunes backup of your phone, YOUR OK!!!!
just DONT UNINSTALL ITUNES OR DELETE THAT FOLDER!!!!
once you get a hold of that file, you can manually put it back in /private/var/mobile/sms folder on your iphone, and, BOOM, your sms stuff is back........
06-30-2009, 08:23 PM #45
I've followed everything successfully (I think) and I've got as far as entering,
dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img'
I then gave the password requested which appears to have been accepted - there are no error messages. However, there appears to be no activity on the computer or iphone. Should i be able to see anything transferring at this point?
07-04-2009, 01:59 AM #46
Right, I've found the iphone-dump.img in the 'Home' file.
Also, I've realised that you won't see any progress bar for the disk image transfer. To check it's progress, highlight the image and 'get info'. Each time you check, you should see a larger file size.
Another problem I encountered was that the phone's battery kept dying before the transfer was complete. Despite the phone being powered via USB or mains electricity, the amount of power needed to power the transfer is more than the amount the phone is being charged - but i worked that bit out!
I have a 16GB iPhone 3G. The phone's battery dies before I am able to transfer the entire disk image. During the transfer I noticed that the phone gets really hot on the back. I realised that electricity must be being lost as heat. So... I placed the phone on top of some frozen peas and after a very short time the phone began charging up again!
I eventually get a 15.12GB image of my iPhone hard drive
This is where I'm now stumped. I want to now mount this image and run a recovery software on that mounted drive.
My problem is that I can't mount the image. Under OSX, whether it be using Disk Utility, DiskImageMounter, Stuffit File Expander etc, I get the error "no mountable file systems". I get a similar error trying to use the mount command 'hdutil attach iphone-dump.img' in Terminal. I've done an exhaustive search on the internet searching for answers. I've found others having similar problems.
I wonder if anyone has any ideas to help out.
07-06-2009, 02:47 AM #47
I am trying to recover dictaphone data (audio files) from Speakeasy.
I have got as far as being able to create the disk image on my mac - it is 6.23 G from a 16 G phone.
Is that plausible?
Now anyone got any ideas how I can try and get the CAF. Core Audio Files off the image?
I just downloaded Photorec but I don't understand how to point it directly to the image. Do i have to install photorec as a unix command or something?
Last edited by baeretswil; 07-06-2009 at 02:47 AM. Reason: Automerged Doublepost
07-11-2009, 10:10 AM #48
08-11-2009, 12:18 AM #49
ok guys, I basically crashed my iphone and had to jailbreak it again, but I didn't have a back up of any of my contacts and now am in a heap of steaming, you know what. At any rate, I have openssh on the iphone with bigboss pref to activiate it, and then I have terminal loaded as well. I have winscp on my XP 32 bit machine and I can get into the iphone, but my iphone doesn't seem to want to talk back to the PC, hence I can't dump the memory onto the PC. Any help is greatly appreciated!
When I go into terminal on the iphone, I get
I then type in ssh [email protected] and then it says "ssh: connect to host 192.168.1.4 port 22: Operation timed out.
So basically I can do most of the steps except that it just won't dump the memory. Thanks for any help.
08-12-2009, 01:57 PM #50
08-13-2009, 10:06 PM #51
will try it tonight and let you know . . . there was a great article about this, but they didn't go into enough detail to explain how it works. I'm really hoping this works! Thanks dazz.
I loaded the program and tried to go to the help menu, but I don't understand how to set it up to be able to listen or send information? How do you set it up under XP and then what is the command under terminal on the iphone? I tried ssh ipaddress -1 administrator, which is what it said, but that didn't seem to work? Are there instructions on this site or another to help in setting that up? Any help is appreciated!
Here is a great article, but I can't figure out the step how to get into the iphone.
iPhone Forensics White Paper – Zdziarski technique – viaFORENSICS - viaFORENSICS
Any help is appreciated!
Last edited by dl3r; 08-13-2009 at 10:06 PM. Reason: Automerged Doublepost
08-14-2009, 01:54 PM #52
Hi, i can't get this to work (I'm running windows 7) I write everything and the i get this
sh: Felipe: No such file or directory
I've tried everything, using c/iphonedata/iphone- home/iphonedata/iphone- c/iphone-dump.img' but nothing works.
Please help me I need to recover some aiff files recorded with iTalk.
08-19-2009, 09:49 AM #53
This is what I did. I opened up SSH on my computer and logged in with the username and password. I went to my iphone and went to the terminal and then did the following:
iphone:/var/mobile root# (this is what displays)
I then type in SSH ([email protected]_address) and it asks for a password. I put in my password, but the yellow cursor doesn't move when I put in my password. It then says permission denied, please try again. After failing I decide to try to ssh anyways and I type this:
su dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img' but then it says su: user dd does not exist and then it says [email protected]'s password: with a flashing yellow cursor.
I know I'm close, can anyone tell me what I'm missing? Thanks!
08-21-2009, 03:41 AM #54
I followed the tuturial step by step, but every time i get the following error:
dd: reading /dev/disk0': invalid argument
0+0 records in
0_0 records out
I tried to find out if there were any problems with dd or ssh by entering the following line:
dd if=/dev/zero | ssh [email protected] 'dd of=dump.img'
This worked well, there was an image created called dump.img (of course without the data i needed), so I would say everything should work fine. But then the question, why do I still get that error?
I'm using a 32Gb 3GS iphone and Mac OS X leopard
08-24-2009, 11:47 AM #55
I got stuck at ssh [email protected], keep getting a timed out error. Any hint to help me get pass this stage?
Installed openSSH and mobile terminal on my jailbbroken 3g and winCSP, putty and dd.exe on my Windows PC. I can ping my 3G no problem using my PC cmd command or putty, can also log into my 3G with winCSP and copy/transfer data to and from the 3G. Just can't get iphone to ping my PC successfully.
08-31-2009, 12:02 AM #56
08-31-2009, 06:24 AM #57
Hello guys, i was wondering if anyone could help me with this.
First of all, i'm a total newbie and don't really know what i'm doing :-), i just followed what i read on this great forum.
I had to restore my 3G, I managed to jailbreak it and unlock it (to my surpirse :-)) and now i've been trying to get some data back, that i never backed up :-(.
After 3 long evenings of learning and trying to dump the iphone's image file, I managed to start the dumping process, but it always stops at exactly 6,529,444 KB. Tried it 3 times and i get this error:
iPhone:~ root# 6686150656 bytes (6.7 GB) copied, 9504.19 s, 703 kB/s
-sh: syntax error near unexpected token `('
iPhone:~ root# Error reading file: 109 The pipe has been ended
I cant figure out what causes the dumping process to stop at exactly the same spot. Can anyone help me with this?? please?
09-01-2009, 07:35 AM #58
09-02-2009, 01:35 PM #59
I got through this part just fine, I can't moved on to the next though. Keep getting the timed out error.
09-28-2009, 10:18 PM #60
I need to recover ~600 baby pictures from my jailbroken 3.1 iPhone, but I seem to be missing BSD Subsystem and can't add any new sources. Is there anyway to get this to work? I'm probably missing something simple, but I REALLY need to get the pictures after iTunes said backup complete twice and I went to restore after my jailbreak and non of my data was there anymore
Any help? TIA