Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.
Thread: HOW TO: iPhone Data Recovery
08-05-2010, 05:13 AM #121
hey i just wanna add some infos which may help in this thread:
if you are on IOS 4 or IOS 4.0.1 there is no need to install MobileTerminal as there is no one supported yet you can simply ssh from your PC to your iPhone then ssh again to your PC from ur Iphone through the terminal opened in your PC to DD the file simple and easy
as i found some problems from iphone in maintaining the WiFi connection as it always drop down i'm searching in how to use this method through tunneling from iphone using USB cable to ignore the WiFi connection with the low speed transfer rate
what OS u using??
ok guys i'v found a way to do this but using USB not WiFi :
things i used :
Iphone 3G with OIS 4.0.1 jailbreaked
Ubuntu on windows
Openssh from Cydia ( no need to install MobileTerminal )
download itunnel into Ubuntu : http://www.cs.toronto.edu/~jingsu/it...nnel-0.0.9.tgz
Unzip the file and CD into it
run ./itunnel from a terminal
leave the terminal and open another one and test the ssh connection with the port 3023 :
ssh -p 3023 [email protected] then enter the password then close itunnel
now you need to do a final step before coping is to allow connection from PC to the iphone without promoting a password
from ubuntu : ssh-keygen -t rsa
press enter 3 times without entering a phrase
now open ./itunnel from a terminal , from another terminal enter :
cat .ssh/id_rsa.pub | ssh -p 3023 [email protected] 'cat >> .ssh /authorized_keys'
then enter alpine for the last time
open ./itunnel again in a terminal
in another terminal type the following command :
ssh -p 3023 [email protected] "dd if=/dev/disk0" | cat - > /home/(your_user_name)/iphone.img
open another window and cd to your home and enter :
watch ls -lh
and watch your iphone.img file growing
PS : if coping hang edit in Ubuntu /etc/ssh/ssh_config and add ServerAliveInterval 60
then restart ssh :
sudo service ssh stop
sudo service ssh start
then try again
Last edited by Assoor; 08-23-2010 at 01:25 AM. Reason: Automerged Doublepost
08-08-2010, 11:09 AM #122
I was just using my iPhone 4 on iOS 4.0.1 installed mobile terminal (a beta i found on the net). All the comands run down smoothly. only thing: the .img doesn't stop growing. It's an 16 GB iPhone an the file is now 35 GB big. Is that normal. When will it stop? thanks you very much
08-08-2010, 11:55 AM #123
I am new here. I followed the guidelines posted here and managed to get the image file. I am using 3GS but couldn't successfully recover any files using photorec.
Anyone has suggestion on what photorec setting should I try? When I dump the image, I have to use block size BS=4096KB parameter (otherwise, I got ;invalid argument'). I am wondering if this setting affects how the image block is created, thus affect the recovery process using photorec and must use the correct setting to recover. I was trying to change the block size in photorec (using expert option) but no success, perhaps because there is no no 4096KB as an option. I saw in manual that you can setup the blocksize to any number but I am not sure how exactly to do it.
So, anyone can help here by suggestion any parameter? Thanks in advance.
08-09-2010, 12:02 AM #124
i would just like to thank everyone for there support, i have not yet had any success from recovering data from the DD. i was able to create both dd's of the iphone 4, but no data recovered with photorec, i did find an interesting piece of software located @ Phone Image Carver: Extract files from forensic cell or mobile phone image files im currently scanning my DD with that software.. i will let you know of the outcome. ::crossing fingers::
08-09-2010, 12:17 AM #125
to make sory short, I recorded a very important video on my iphone 4 (me proposing to my fiancé) just after activating it. Then I stupidly did a restore from my 3GS backup and now the video is gone.
So I followed all the instructions and successfully created the dump.img of my iphone 4. I used Photorec to recover the video (note all data that I have on the phone before I did the backup was the video) but photorec recovered 2 files. One of the files is a 1.7GB mpg file (no way my video was this big) and one is a 4GB flash file. I could not play the mpg file in any of my video players. I wonder if the actual video is within the mpg file?
Please if anybody can help me, I would really appreciate it. I haven't slept for a day trying to figure out the way to create the img file and now that I have it I can't do anything with it.
Thank you in advance.
08-09-2010, 01:12 AM #126
If you saved a dd image of the entire iphone disk you won't be able to simply mount it. The disk is made up of 2 partitions:
Filesystem Size Used Avail Use% Mounted on
/dev/disk0s1 1.0G 824M 190M 82% /
devfs 36K 36K 0 100% /dev
/dev/disk0s2s1 30G 2.0G 28G 7% /private/var
The filesystem type is "hfs" :
/dev/disk0s1 on / (hfs, local, noatime)
devfs on /dev (devfs, local, nobrowse)
/dev/disk0s2s1 on /private/var (hfs, local, journaled, noatime, protect
If you want a dd image(s) that you can mount, you would need to make 2 images, using /dev/disk0s1 and /dev/disk0s2s1 as the input rather than just /dev/disk0
08-09-2010, 04:12 AM #127still trying
So I'm posting another time.
Still having problems to get the .img to my mac.
Just did a screenshot of my terminal for maybe making things clearer.
So I can ssh into the mac from the iphone. then doing the su thing.
then running " dd if=/dev/disk0 | ssh [email protected] 'dd of=idump.img' "
but this just gives me an endless growing .img (the thing caneled with a size of 199GB when my harddrive was full).
If I'm using Blazer0x's "/dev/disk0s1" and "/dev/disk0s2s1" then it works perfect for the first one (getting an mountable 200mb img file). but for the second (as you can see from the screenshot) it doesn't work.
I'm sure some of you guys have an idea on that. so if you do, and share. that would be genius.
thank you very much in advanced.
08-09-2010, 08:09 AM #128
I tried the reverse process. Instead of dd'ing from iphone, i tried dd from my pc. The format is something like this:
ssh root@[your_iphone_ip_address] dd if=/dev/rdisk0 bs=8192 | dd of=dump.img
You may also want to try the following from your iphone:
dd if=/dev/rdisk0 bs=8192 | ssh [your mac address] 'dd of=dump/img'
Note that I used bs=8192 (also tried bs=4096KB. See if that works
08-09-2010, 03:47 PM #129
and one more thing, I was using
dd if=/dev/rdisk0s2 bs=4096KB | ssh [email protected] 'dd of=/media/windows/dump.img'
to get the image from my phone. Am I screwed in getting back my video? Or is there another program that I should wuse beside Photorec? Please help. Thanks
08-12-2010, 10:58 PM #130
A word of advice:
I tried this method for research purposes on iPhone 3GS. It did not work. I believe it cannot work on newer hardware.
What I did:
1. Fill a file with a hex pattern that's easily recognizable:
printf "\xDE\xAD\xF0\x0D" > deadf00d
2. Replicated the file with cat file >> filex2 ; cat file >> filex2 ..
until it weighs 4M
3. Filled all free disk space (~30GB of 32) with that 4M file:
while true; do cat 4Mpattern >> \filler ; done
4. Made sure dd command really reads the pattern : dd if=/dev/rdisk0s2s1 bs=$[0x10000] count=1 skip=$[0x10000] | xxd # reads a block at 4GB offset, tried different offsets between 1 and 30GB
5. Restored the device and re-jailbroken it with Spirit/Star JB using DFU mode restore with cached ECID to 3.1.2 and 4.0.1 FW.
On 4.0.1, dd reads zeroes from all sectors not already filled with data
On 3.1.2, dd reads random garbage - meaning that user volume encryption key is changed during restore, and the data is gone the moment that happens.
This likely also applies to all devices that have encrypted user volume - 3G and newer iPod Touches, 3GS and 4 iPhones and the iPad.
The Following User Says Thank You to msft.guy For This Useful Post:
08-14-2010, 05:13 AM #131
Anybody has successfully recover data using 3GS?
I got the image using various parameters but still unsuccessfull in getting the data using photorec and other softwares. So, I am starting to think that probably because I am using newer hardware as what mentioned by msft.guy. That means, no hope in recover the data
08-21-2010, 01:58 PM #132
I am using an iphone 3g
and I download Ubuntu for Windows
I downloaded the itunnel file and CD'ed into it
however when I try to do ./itunnel
I get the following error
bash: ./itunnel: No such file or directory
Please can you assist me with this..
UPDATE: Nevermind I got it to work, it's apparently because of the 64bit system.
I ran this apt-get install libc6-i386 lib32gcc1 lib32z1 lib32stdc++6 ia32-libs in Ubuntu's terminal
and now the executable is functioning well...
UPDATE 2: Now that the previous problem was fixed I ended up with this problem in the end...
root@ubuntu:~# ssh -p 3023 [email protected] "dd if/dev/disk0" | cat - > /home/rana/iphone.img
[email protected]'s password:
dd: unrecognized operand `if/dev/disk0'
Try `dd --help' for more information.
can I get assistance on that..I tried the whole method a few times but always ended up getting that...also when you say leave terminal I am assuming that I leave the current one open and start another separate terminal.
and I am using Crtl+C to quit from itunnel, is that the correct method?
Last edited by freezepop; 08-21-2010 at 03:52 PM.
08-22-2010, 05:31 AM #133
Nice guide thanks for sharing
08-23-2010, 01:23 AM #134
08-24-2010, 05:55 AM #135
I was using Ubuntu live CD and when I connect iphone via USB, Ubuntu mounted the iphone as USB device straight away and I can browser the files. I am new to Linux but I am just thinking, if the iphone is recognized as a device in Ubuntu via USB, can I just dump the iphone drive using linux command to clone or dump as it is an attached drive. This way, we don't need to use SSH or USB tunnel to dump iphone memory. Not sure if this can be done. Calling all Ubuntu expert here, is this way possible?
08-25-2010, 12:49 AM #136
08-26-2010, 02:03 PM #137
a little help please anyone
so i got the iphone connected to ubuntu and itunnel mentioned in the USB connection method, everything seems fine and the .img is created but after the initial 59mb have been copied over, it seems to hang and nothing else is copied over.
i read that i need to edit the etc/ssh/ssh_config file in Ubuntu with the ServerAliveInterval 60 do i need to add a 'hash' in front of the command?
or is there any other reason for why it hangs on the initial 59mb and nothing else copies over?!??
Last edited by ip3gs; 08-26-2010 at 02:46 PM. Reason: update
08-29-2010, 12:54 AM #138
09-03-2010, 08:30 AM #139
My results have been the same. No luck on a 3GS. I was able to transfer the full image of the device, but no photos at all ( even current ones) could be found. May not work on newer devices.
09-14-2010, 11:28 AM #140
Thought I would chime in here.
First thanks for this. It has been an education.
MBP OSX 10.6.4
iPhone 4 32GB 4.0.1 (the one with the more gb's and the wifi's)
The ONLY way I was able to get the first part (extracting the image file) was to combine the steps in the Mac version of this walkthrough with the USB tcprelay walkthrough by Marcan. I set up port forwarding from local 2222(Mac) to remote 22 (iPhone). Then in another Terminal session on MBP ran
ssh root@localhost -p2222 dd if=/dev/rdisk0s2s1 bs=4096KB | dd of=/Users/[username]/ip4.img
From that point I had no joy carving out any image files using photorec. All I got was a an error message about a bad sector and a single .mpg file that was 31.18GB. I also tried using the bs=1M switch and got the same results. Perhaps I missed something or I haven't set the options correctly in photorec. IDK. When I try to mount the image in OSX it just says "no mountable file systems".
Anyone had this issue with photorec?