HOW TO: iPhone Data Recovery

[thewitt]

OK... I don't know what happened, but I finally started getting a transfer (user error?).

And now, as above, I have an unmountable image (8 Gb). I'm on OS X, what should I use to recover?

Thanks for the input.

[strifej]

Ok, wanted to return something to the community here.

I helped my gf grab files off her iphone. I didn't do this process myself, but I did the research for her, so I'm familiar with most of the issues.

*NOTE: DO NOT DO AN ITUNES "RESTORE FROM BACKUP" ON YOUR PHONE BEFORE ATTEMPTING THIS. YOU'LL PROBABLY OVERWRITE A LOT OF STUFF MAKING IT IMPOSSIBLE TO RECOVER MUCH. IDEALLY YOU HAVE A PHONE WITH A CLEAN IMAGE (DFU MODE, ITUNES RESTORE OS ONLY) AND JAILBROKEN.

We tried doing everything using Windows, but there were so many problems we gave up.

Major credit to spoonsslick and the original poster. I used spoonsslick's instructions for doing everything using a ubunto livecd. Here are my modified instructions with more details:

Linux experts or whoever, unless you believe I'm suggesting something that is VERY wrong, please don't critique as you'll just add more spam to the thread with ineffectual suggestions.

Ok, here are instructions that I know work (using WiFi):

Move your computer/laptop and iphone close to your router to maximize transfer speeds.

Download and burn ubuntu to a CD or DVD:

http://ftp.ucsb.edu/pub/mirrors/linu...sktop-i386.iso

* I write a lot of comments in parentheses (), so don't actually type stuff in brackets.

On your computer/laptop:

Boot from liveCD (you may need to go into your BIOS and re-arrange the boot order such that your CD-ROM loads before your hard disk containing windows. google for help if you need.)

- Open a terminal window, install sshd by typing:
sudo apt-get install openssh-server

- Update root password (I know the 2 commands below probably do the same thing, but no harm doing both):
sudo passwd
sudo passwd root

sudo -s (this should change you to the root user so that you have full control over your system)

fdisk -l (this should list all your hard drive partitions)

you'll see an output like the following:

Device Boot Start End Blocks Id System
/dev/hdb1 * 1 2432 19535008+ 86 NTFS
/dev/hdb2 2433 2554 979965 82 Linux swap / Solaris
/dev/hdb3 2555 6202 29302560 83 Linux

look on the right end of each line to find something that matches your local hard disk drive (it'll most likely say ntfs)
find the device (line) you want, and note the /dev/XXX in the front of the line. the XXX represents your partition

mkdir /media/windows (creates a folder to link your drive)
mount /dev/XXX /media/windows/ -t ntfs -o nls=utf8,umask=0222 (link your drive)

replace the XXX with your partition from the fdisk command

for example, on my laptop, it was this (sda2 was my partition identifier):

mount /dev/sda2 /media/windows/ -t ntfs -o nls=utf8,umask=0222

cd /media/windows2
ls -l

the above 2 lines should display the contents of your drive. look and see if you recognize files from your HD. if you do, you're good to go. i'm not sure why spoonsslick didn't provide instructions for this because ubuntu creates a 1gb ram disk, and your iphone image will be minimum 8 gb... so you'd be stuck after transferring 1gb. if someone has better instructions on mounting a HD in ubuntu, feel free to comment.

find your ip address, look at inet addr:
ifconfig (or is it ipconfig? my gf didn't comment, so i guess one of these commands will give it to you)

Your computer/laptop at this stage should be ready to receive and write the dd dump file.

***************************

Ok, now to iphone:

You'll need a jailbroken iphone. Google if it's not to get instructions.

Our home network uses the standard 192.168.1.### ip range standard on most routers. If you use something else, then change the first 3 octets to match yours in the instructions below.

In cydia, install terminal, mobileterminal, and openssh. Reboot iphone. I remember one of the terminals didn't actually create an icon to run the terminal program, so just install both to save time.

set phone to auto dim and set phone to a lower brightness to use less battery (in case phone runs out of power sending over wifi before the file gets transferred; someone earlier had this problem, but we didn't)

start terminal on your phone by clicking the icon:

type the following commands:

ssh [email protected] (xxx is IPHONE ip - password alpine)
rm .ssh/known_hosts (this removes the saved host keys so you don't get permission denied error if you boot from the live cd more than once since each new boot creates an unique key that will mess everything up)

ssh [email protected] (xxx is computer ip, we run this so it will ask you if you want to save the key, type "yes")

exit (you ssh'd into the computer, "exit" gets you out since you don't want to actually be in the computer directly)

dd if=/dev/disk0 | ssh root@<computer ip> 'dd of=/media/windows/dump.img'

replace the <computer ip> with your computer ip. hopefully it'll ask you for the root password and then write to your mounted HD

if your network is fast and you can get 500k+, it'll take a few hours. make sure your phone is plugged into the wall to get maximum power recharge so your phone doesn't run out of battery partway through.

**************************

You have a dump image file. Don't try to mount using poweriso/ultraiso/magiciso as that's not what you want to do.

Google photorec and learn to use that. The first few links will give you decent instructions, or you can fool around a bit yourself. If you didn't overwrite your phone flash, you should be able to recover quite a bit.

Good luck.

[VampiraQula]

Okay thanks for the thread I have successfully created an .img of ipod touch. Now I have a problem with photorec. I scan the file and photorec only finds hundreds of .txt files. Dose this mean my data is lost?

I ran another scan and found tons more files.

What file is the contacts file. *.sqlitedb? or what

[Rwcabrera]

Try looking for the file type option in the photorec and make sure the .jpg box is selected.

[siethoo]

Hi,

I've posted a detailed Mac-specific guide at:

Guide: Recover Lost or Deleted Photos/Files on iPhone 3G/S (Jailbroken) on a Mac

I was able to recover lost images today from an iPhone 3G and 3GS using PhotoRec. Hope this helps.

[adventuretwist]

If you have iTunes backups then it's easy to browse and recover the contents udner all operating systems with the free iPhoneAnalyser tool. Available on https://sourceforge.net/projects/iphoneanalyzer/.

[rerg15]

Ok hi everyone,

so I successfully did everything, got a 20 GB .img file sitting on my hard drive, scanned it with photorec, recovered a whole bunch of stuff I don't need to recover, including all kinds of website info, pictures and music...


But I still can't find the very files I actually care about: MY NOTES. I got over a 1000 .txt files from the recovery and they don't seem to be there. Has ANYONE recovered deleted notes from an ipod touch that has been restored? If most stuff from the native built-in apps are still present in the img file, logically the notes should also be there.

Can anyone help please? Am I overlooking something? What format do you think notes are in? or would I get different results if I ran the scan using different settings? Do I need special software to read certain format types? help!!!

regards.



by the way, here's the link that helped me. I used Ubuntu and everything runs smoothly if you do it right (scroll down to "extract individual files from recovered image" and follow the instructions):

https://help.ubuntu.com/community/DataRecovery

[Empowers]

On what level the iPhone must run that i can make an image.
Did this work in DFU?

[rerg15]

In Normal mode, as it usually runs. It just needs to be jailbroken with openssh and MobileTerminal installed

[atlas01]

Hi guys just wondering if anyone might be able to shed some light.

I have a iPhone 3GS 32gb (new boot ROM), jailbroken with blacksn0w.

I SSH-ed into the iPhone using an Ubuntu live-cd, and managed to dump a 30gig image using the following command:

dd if=/dev/rdisk0s2 bs=4096KB | ssh [email protected] 'dd of=/media/windows/dump.img'

I've run Photorec on the file under Windows, and it has recovered a lot of png and txt files, but no jpg. The jpg option is definitely selected in Photorec.

I did notice however that there was a 29gig .GPG file, which according to google is an encrypted file.

I'm curious - none of my music (which would easily be a few gig) nor photos have been recovered. Could they be inside the GRP file?

[ilavu]

I got the 8gb phone and image file size is 7.6gb. When tried to mount image in the magicdisc software, error says "Failed to mount image". Any one with same problem have any info to solve? Need help to recover some photos. I also have itune backup but asking for the passcode that never been setup so don't know.

TIA.

[Edmundo096]

Hi, I have a 3GS, I dumped rdisk0s2s1 from cyberduck trough wifi.
When I put it in a windows partition and then start photorec from windows, it dont founds anything of photos taken before restore.....
WTF? why photorec doesnt found anything? it recovers a .swc file of about 10 GB or more but i ran out of space??
Any suggestions of what i can do??
thanks

[nave3d]

Im getting the same error as most of the other people.
0 byte img and dunno wtf to do with it

just installed ubuntu and openssh on it and im still getting the same error

dd: reading '/dev/disk0': Invalid argument

[army113]

thanks for your great guide
got my contacts databese from a restored phone, couldn't get them from anywhere else because my hdd broke at the same time
repect man

[Vecos]

thanks for your great guide
got my contacts databese from a restored phone, couldn't get them from anywhere else because my hdd broke at the same time
repect man

Would you mind giving a short step-by-step run-through of the process you used to recover your contacts database? My phone got bricked in that Rock debacle and I'm trying to recover as much data as possible, but don't know where to look for my contacts and notes and the like... Many many thanks in advance!

[army113]

Would you mind giving a short step-by-step run-through of the process you used to recover your contacts database? My phone got bricked in that Rock debacle and I'm trying to recover as much data as possible, but don't know where to look for my contacts and notes and the like... Many many thanks in advance!

First you have to reinstall the firmware (i guess you already did) and jailbreak it. You might also get an Ubuntu Live CD (or some other distro)
Do not install any apps except those that I tell you (unless you want to lose more data than you already did):

• OpenSSH

After installing those apps I connected to my iPhone with

ssh -l root <your-phones-ip>

Type this into the computer terminal, not iPhone's.

On your iPhone set your screen to never lock and connect it to a power source. You might also want to put it near the router for faster transfer speeds.
Then in your terminal connected to the iphone issue the command

dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img'

You can also add a path in front of iphone-dump.img

Then you have to wait, the terminal gives no output about it's progress but you can monitor the file size in file browser on your computer.
When it's finished (you have acces to the terminal again) install testdisk to your PC.

sudo apt-get install testdisk

Cd to the directory you saved the iphone-dump.img and use the command

sudo photorec iphone-dump.img

After the program starts click enter and than select [Mac] Apple partition map and than pick File Opt and select the file types you want to recover (sqlite for contacts and other databases, jpg and png for pictures - just take a look and you will see).
Than go back to the menu and than click Search.
Click enter and pick [Other] and than choose where you want to save the recovered files. Make sure you have enough space. You navigate with left and right, when you get to the desired folder click on the line with one dot and click enter. Than the search starts. It might take a while.
Than you can browse the recovered files and find the ones you need.

Worked great for me, got my contacts back but lost the SMS database tough.
If somebody didn't understand something just contact me and I'll try to explain better. And again thanks for the original guide to lmarr28.

[Vecos]

Looks very promising - Will give it a shot and hope for the best... Thanks so much!

[devonian69]

Looks very promising - Will give it a shot and hope for the best... Thanks so much!

I finally got the raw dump to start copying over last night. If its 16GB, its going to take over a day to copy with connection on my laptop. I should have a better idea of what I have to work with by tomorrow night after work.

Army113's guide is very helpful!

I will post again with any news. Hopefully I'll be able to recover at least 50% of what was lost.

Definitely be mindful of storage space. I am using an old laptop and started the whole process before realizing that the ubuntu partition wouldn't hold the disk image. I hooked up an external hard drive and it appears to be storing it without any problems.

Does anyone know if an interrupted file will still work? Just in case something happens, will I be able to try and use that portion to pull files from it? (if it happens, I'll know for sure I guess).

[army113]

Well the first time I tried this procedure the dump process stalled at 7GB (8GB iPhone 2G) and the recovery program didn't have any problems reading the files. AFAIK in searches directly in the disk sectors so it doesn't really care about fully copied files and stuff like that.

[rikwen-5]

Windows 7
iPhone 3GS
Cygwin

It starts writing on my laptop but the phone reboots when ~767mb is written, i got three equal big *.img, same problem each time.
What could be wrong? I have set bs=1M, could that affect it? dont now what to try with...

/Rikard