[lmarr28]

Recently, I bricked my iPhone and had to restore it in iTunes. In the process, I lost a bunch of photos from my Camera Roll that hadn't been saved to my computer yet. After an endless amount of Google searching, I finally found a way to recover, or "undelete" data from the iPhone. This guide will focus on recovering photos, since that's what I had to do, but the same process could be used to recover other lost data.

What you'll need:
- Jailbroken iPhone
- BSD Subsystem and OpenSSH installed on your iPhone
- Terminal (or MobileTerminal) installed on your iPhone
- An SSH server installed on your computer (mine is running Ubuntu 7.10 with OpenSSH)
- The 'DD' utility installed on your computer (this should be pre-installed on most Linux systems)
- Your iPhone's IP address
- Your computer's IP address

First, make sure that your iPhone and computer are on the same LAN. You can try to ping your computer from your iPhone (using Terminal) and vice versa, just to make sure they can see each other on your LAN. For example:

ping 192.168.1.215

Next, you'll want to make sure that you can SSH into your computer from the iPhone. To do that, open Terminal on the iPhone and enter:

ssh <username>@<computer-ip>

Where:
<username> = Your user name on the computer.
<computer-ip> = Your computer's IP address on the LAN.

If that worked, you should be prompted to enter a password for <username>. If the connection times out, then you need to make sure that you have the SSH server running on your computer and make sure that port 22 (the default SSH port) isn't being blocked by your router's firewall.

Once you know that your iPhone and the computer are talking to each other, open Terminal on the iPhone and run the following command to begin transferring the iPhone's "disk" image to your computer (be sure to run this as root using 'su'):
NOTE: Make certain that your iPhone's screen lock is disabled first. If the screen lock comes on, it will kill the SSH connection. Also, you'll want to connect your iPhone to its charger. This transfer can take a while.

dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img'

The above command will create a "disk" image of your iPhone (named "iphone-dump.img") on your computer. Feel free to use a different name or a different destination directory. For example: 'dd of=/home/username/iphone-dump.img'.

Also, be sure that you don't mix up the "if" (input-file) and "of" (output-file) in the command above. Doing so could wipe-out your iPhone.

After the process has completed and the iPhone's image file has been saved to your computer, you can use a program like PhotoRec to recover your photos.

I hope this helps!

[ajrulez]

Excellent post!

Mods, please make this sticky if possible.

[furyspec]

Thanks!!! I'm gonna try it! I just bricked my phone before, so this is helpful, ill let u know if it works

[msbreton]

I get a dd: opening `/dev/disk0`: Permission denied

Any ideas?

-mike

[cipher64]

Can someone please help with the permission denied error....thanks.

[lmarr28]

Originally Posted by msbreton

I get a dd: opening `/dev/disk0`: Permission denied

Any ideas?

-mike

You might have to run the DD command I mentioned above as root on your iPhone. That's what I did and it worked for me (I never tried it without being root though).

To do that, as soon as you open the Terminal app on your iPhone, run the command: su

You should be asked to enter a password. The password should be: alpine

If that worked, try running the DD command again and see if you still get the permission denied error. If it didn't accept the password, you may need to install the "BSD Subsystem 2.x SU Replacement". (The su command that came with BSD Subsystem 2.0 and 2.1 was broken -- this fixes it.)

To install it, add the following source to your installer app:
http://iphone.lenlolabs.com

Hope this helps!

[Shasha04]

So I made it through most of the steps, got my computer and iphone (1.1.4 ziphone) to connect, got past the "permission denied" error, but then I get a "dd: not found" error.

I believe this is because I have Cydia instead of the BSD Subsytem, and it probably doesn't have the dd utility.

So, what do you guys suggest? Uninstall Cydia?

I'm also wondering if syncing will cause me to lose any potentially recoverable data.

Originally Posted by Shasha04

So I made it through most of the steps, got my computer and iphone (1.1.4 ziphone) to connect, got past the "permission denied" error, but then I get a "dd: not found" error.

I believe this is because I have Cydia instead of the BSD Subsytem, and it probably doesn't have the dd utility.

So, what do you guys suggest? Uninstall Cydia?

I'm also wondering if syncing will cause me to lose any potentially recoverable data.

Ok, so I do have the dd utility. I realized that I couldn't be getting a "permission denied" error without it. I also noticed I have internal help files for that command.

So, my problem is: I type in the command. I get some scrolling stuff and a password prompt for my pc. I type in that password, more stuff scrolls, and then I get an error that says "dd: not found"

What the hell is not found??

[lmarr28]

I'm not familiar with Cydia, since I've never used it, but I can tell you that you will need the BSD Subsystem installed for it to work.

When you delete something from your iPhone (or in this case, when you do a "restore" in iTunes), it's not actually removed from the flash memory... The data is still there, it's just been "flagged" so the OS knows that it's OK to overwrite that section of memory. So, anything you do on the iPhone could potentially overwrite some of that recoverable data (e.g. syncing, taking photos, saving notes, etc.).

Originally Posted by Shasha04

So, my problem is: I type in the command. I get some scrolling stuff and a password prompt for my pc. I type in that password, more stuff scrolls, and then I get an error that says "dd: not found"

What the hell is not found??

Ahh... I completely forgot about that. You'll need DD on your computer as well, since the command that you're running uses DD on the PC-end to create the image file. I didn't mention it before because DD comes pre-packaged with most Linux distros.

[Shasha04]

Alright, I figured out my problem and wanted to post it here for the next person to run across it.

I was using OpenSSH for Windows. Windows does not have dd. To use dd, you need on both machines (your phone and the machine you are sshing into), so my error was that dd was not found on my Windows machine.

So, Windows people, either throw in a Knoppix disk, or find a friend who will let you ssh into their unix box like I did

Anyone got stats on how long this transfer will take?

Originally Posted by Shasha04

So I made it through most of the steps, got my computer and iphone (1.1.4 ziphone) to connect, got past the "permission denied" error, but then I get a "dd: not found" error.

I believe this is because I have Cydia instead of the BSD Subsytem, and it probably doesn't have the dd utility.

So, what do you guys suggest? Uninstall Cydia?

I'm also wondering if syncing will cause me to lose any potentially recoverable data.



Ok, so I do have the dd utility. I realized that I couldn't be getting a "permission denied" error without it. I also noticed I have internal help files for that command.

So, my problem is: I type in the command. I get some scrolling stuff and a password prompt for my pc. I type in that password, more stuff scrolls, and then I get an error that says "dd: not found"

What the hell is not found??

Cool, yeah, I figured that out before I saw your reply. FYI, Cydia is an opensource alternative to BSD Subsystem and Installer.app. It has all the BSD Subsystem tools packaged in it, plus others, and leans more to the development community in terms of Unix utilities that have been ported over. It even has color highlighting vim.

So for the record, this method does indeed work with Cydia.

And yeah, I had a feeling syncing might be the moment when stuff gets literally deleted.

Originally Posted by lmarr28

I'm not familiar with Cydia, since I've never used it, but I can tell you that you will need the BSD Subsystem installed for it to work.

When you delete something from your iPhone (or in this case, when you do a "restore" in iTunes), it's not actually removed from the flash memory... The data is still there, it's just been "flagged" so the OS knows that it's OK to overwrite that section of memory. So, anything you do on the iPhone could potentially overwrite some of that recoverable data (e.g. syncing, taking photos, saving notes, etc.).



Ahh... I completely forgot about that. You'll need DD on your computer as well, since the command that you're running uses DD on the PC-end to create the image file. I didn't mention it before because DD comes pre-packaged with most Linux distros.

[scroll1]

Thanks Imarr28 for a great guide. I have got an image off my 16G iphone. Could you explain how to mount the image? I thought I could mount it as:

#mount -o loop iphone-dump.img

but it errors with "you must specify the filesystem type"
I've tried this under linux and under OSX...just can't mount the image.
Any help would be appreciated.
cheers

[lmarr28]

Originally Posted by Shasha04

Anyone got stats on how long this transfer will take?

...

And yeah, I had a feeling syncing might be the moment when stuff gets literally deleted.

Don't sweat the syncing stuff. I literally went about two weeks after restoring my bricked iPhone before I did this recovery procedure and I was still able to recover about 90% of my lost photos. During those two weeks before doing the restore, I was using my iPhone as normal (syncing, taking photos, etc.). So there's still a chance that you can get a lot of your data back.

As for the transfer time, it took me about 3.5 hours for an 8 GB iPhone. I wasn't very close to my wireless router though, so that could have had an effect on the transfer speed.

Originally Posted by scroll1

Thanks Imarr28 for a great guide. I have got an image off my 16G iphone. Could you explain how to mount the image? I thought I could mount it as:

#mount -o loop iphone-dump.img

but it errors with "you must specify the filesystem type"
I've tried this under linux and under OSX...just can't mount the image.
Any help would be appreciated.
cheers

I wish I could help you here, but unfortunately I'm really not familiar with Linux/Unix/OSX at all. I'm sure there is someone around here who can tell you though.

Just out of curiosity, why do you need to mount the image? If you're using PhotoRec for your recovery, you can just point it directly at the image file by using the file's name as a parameter at the command line. For example, run: "photorec iphone-dump.img"

[scroll1]

Thanks again Imarr28, I didn't realise that photorec could read directly the .img file. I have got nearly all my pictures back from a 16G iphone. It took awhile to download the image ( I left it going over night) but photorec did the restore very, very quickly...I'm impressed.
thanks again.

[lmarr28]

Originally Posted by scroll1

Thanks again Imarr28, I didn't realise that photorec could read directly the .img file. I have got nearly all my pictures back from a 16G iphone. It took awhile to download the image ( I left it going over night) but photorec did the restore very, very quickly...I'm impressed.
thanks again.

Awesome! I know first hand how it feels to lose a bunch of your data like that, so I'm glad I could help you get it back!

[flager]

Originally Posted by lmarr28

Recently, I bricked my iPhone and had to restore it in iTunes. In the process, I lost a bunch of photos from my Camera Roll that hadn't been saved to my computer yet. After an endless amount of Google searching, I finally found a way to recover, or "undelete" data from the iPhone. This guide will focus on recovering photos, since that's what I had to do, but the same process could be used to recover other lost data.

What you'll need:
- Jailbroken iPhone
- BSD Subsystem and OpenSSH installed on your iPhone
- Terminal (or MobileTerminal) installed on your iPhone
- An SSH server installed on your computer (mine is running Ubuntu 7.10 with OpenSSH)
- Your iPhone's IP address
- Your computer's IP address

First, make sure that your iPhone and computer are on the same LAN. You can try to ping your computer from your iPhone (using Terminal) and vice versa, just to make sure they can see each other on your LAN. For example:

ping 192.168.1.215

Next, you'll want to make sure that you can SSH into your computer from the iPhone. To do that, open Terminal on the iPhone and enter:

ssh <username>@<computer-ip>

Where:
<username> = Your user name on the computer.
<computer-ip> = Your computer's IP address on the LAN.

If that worked, you should be prompted to enter a password for <username>. If the connection times out, then you need to make sure that you have the SSH server running on your computer and make sure that port 22 (the default SSH port) isn't being blocked by your router's firewall.

Once you know that your iPhone and the computer are talking to each other, open Terminal on the iPhone and run the following command to begin transferring the iPhone's "disk" image to your computer:
NOTE: Make certain that your iPhone's screen lock is disabled first. If the screen lock comes on, it will kill the SSH connection. Also, you'll want to connect your iPhone to its charger. This transfer can take a while.

dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img'

The above command will create a "disk" image of your iPhone (named "iphone-dump.img") on your computer. Feel free to use a different name or a different destination directory. For example: 'dd of=/home/username/iphone-dump.img'.

Also, be sure that you don't mix up the "if" (input-file) and "of" (output-file) in the command above. Doing so could wipe-out your iPhone.

After the process has completed and the iPhone's image file has been saved to your computer, you can use a program like PhotoRec to recover your photos.

I hope this helps!

Could you tell me how can I do?
I'm on G5 with Leopard (no airport card installed) connected via ethernet to an airport extreme. Can I connect to the G5 from iPhone to save the disk image? Is there any way?
thank you

[scroll1]

flager,
I'm running Leopard also, but on an intel iMac, with a wireless router attached. As long as you know the ip address of the G5 and as long as you have ssh enabled both on the iphone and G5 and as long as you have a terminal program on the iphone you can do it.
Worked for me and I have retreived nearly all my pictures, even after reinstalling firmware on the iphone.