Guide: Recover Lost or Deleted Photos/Files on iPhone 3G/S (Jailbroken) on a Mac

[ShiBBan]

Sorry for the spamming...

I manage to search the img dump from my iPhone before. All I did was that browsed to the img with Diskutility. Dubbelclicked it so Diskutility tries to open the img, but it will not be able to do this. A messege will come up and same something like "you are owned" and so on...

But under your img a new icon will come up, that's named "Data". When this happens you will be able to search the img with a recovery tool, I used Data Rescue 3 for my searching. Unfortunately I didn't find the files that I was looking for, but maybe you will!

[celerityfm]

(yesterday while trying to import some images to iphoto via image capture the photos got imported to image capture and then they began important to iphoto but iphoto popped up a 'disk error' and the images that were being imported disappeared. image capture deleted the images off my iphone and I haven't been able to find them since -- btw I was using image capture because iphoto fails often when importing pics from my phone when doing it directly).

tldr: i lost some pics, tried to follow the instructions, that didn't work because iOS 4 now encrypts the user volume so you can't get an unencrypted image to run data recover tools on - source http://www.*****************/showpos...2&postcount=27 - however THIS may be a solution, http://msftguy.blogspot.com/2010/07/...oot-pwned.html - will try it and will advise)

tldr (cliff notes): it don't work because I couldn't get umount to work (which may be a ios4 issue), and I tried to skip that part - turns out that part is probably required for anything else to function

read on to see what I tried, hope this helps someone:

**

Started off with this:

Here's an issue with this that hasn't come up yet - when I run umount I get an error:

iPhone:~ root# umount -f /private/var
umount: /private/var: not a directory or special device

Extensive googling doesn't yield any actionable results about the "not a directory or special device" error.

Any ideas guys? Maybe this is something that's no longer possible in iOS 4?

**

UPDATE - I've figured out that I can bypass the need to unmount the volume and just go straight to copying it, atleast, it is copying it [thanks to http://realtechtalk.com/iPhone_3G3GS...-1178-articles and http://log.ijulien.com/post/18280491...-data-recovery for the details on how to do that] - basically I just opened a terminal on my mac and put in

ssh root@myiphoneipaddress dd if=/dev/rdisk0s2s1 bs=1M | dd of=iphonebackup.img

and that's started the process, will advise how it goes!

**
UPDATE 2

strangely my transfer kept cutting out over wifi, it'd get to a certain point and then the transfer would stop and I'd look at the phone and it would seem to have disconnected from my wifi network. So I'd reconnect and try again, but it kept happening. It seemed random and I'm not sure why it did that - maybe my wifi hotspot thought it was being too aggressive on the network? (had autolock turned off and everything). SO I quickly summized I could do this by USB tunnel instead, and thanks to this post http://forums.macrumors.com/showthread.php?t=566598 I got that going quickly - seems to be going faster too! Will advise if the image I get is usable then if photorec works on it

and for the record, this is the command I used once I established the USB tunnel:

ssh -p 2222 root@localhost dd if=/dev/rdisk0s2s1 bs=1M | dd of=iphonebackup.img

**

UPDATE 3

ok the transfer completed, the file I got looks right in terms of size, I can't mount it and I tried photorec first with recommended settings for just jpg/mov/mpg without finding ANY files! Then tried it with all files selected just in case and it recovered a few text files and a large ~7gb ".GPG" file. Doesn't seem right - should atleast be ONE jpg file in there! Trying scalpel now, will advise what I find.

**

UPDATE 4

Scalpel found some additional "files" but they weren't the deleted files - I even modified scalpel's conf with a custom JPG file type that's supposed to be for pics taken using the iphone camera. Which, fyi I found in a book http://books.google.com/books?id=R1X...page&q&f=false confirmed by this (amazing) article http://viaforensics.com/iphone-foren...technique.html -- however no dice. I took these pictures yesterday and since then I've jailbroken my phone and tried to recover the pics, and they are gone. Damn.

I'm also going to try to scan my hd to see if somehow the images that image capture pulled in that disappeared are able to be recovered as well but I haven't been able to get back to that machine since I first did the import, just to close out the story I'll try it later and will advise. iPhone though is a no go

[luvhntn]

This is a Step-by-Step Guide specifically for Mac users to recover accidentally deleted or lost photos/videos or any file directly from the disk of an iPhone 3G/3GS without a recent sync or iTunes backup.

I felt the need to post a Mac-centric guide, and would like to credit the posters of two similar threads (HOW TO: iPhone Data Recovery and Recovering Lost/Deleted Data From An iPhone That Has Not Been Backed Up) as well as Jonathan Zdziarski and VIAForensics.


This method requires a functioning Jailbroken iPhone, low-moderate skill level, and approximately 5-7 hours. If you have deleted files from your Phone, it's important that you don't record more photos/videos or download large files to the phone which may "overwrite" the lost files forever. Use your phone as little as possible.


My Setup
iPhone 3G (3.0) and iPhone 3GS (3.1) - Both Tested Ok
Mac OS X Snow Leopard 10.6.2
A home wireless WiFi Network with both iPhone and Computer on same Network


iPhone Section
1. You will need a Jailbroken iPhone (see iClarified guide)
2. You will need Cydia installed on your iPhone (installed during Jailbreak)
3. Open Cydia
4. Install two programs: Mobile Terminal, and OpenSSH
5. Power Off and On the iPhone
6. Find the IP Address of your iPhone on your Local Network (iClarified)

• Open Settings
• Click Wi-Fi
• Press the Blue circled arrow beside your network's name
• Write down the Phone's IP Address (for this example, I will use 192.168.1.3)

7. Go Back to main Settings screen

• Click Carrier and choose another carrier (or power off and take out your SIM card) so you don't get calls in the process.
• Turn your Brightness down to about 10%
• Plug your Phone into a Wall Charger
• Click "General" and set "Auto-Lock" to "Never" (older software versions may not have this setting, in which case you may have to manually prevent your phone from going to sleep for 5 hours, ouch)
• Exit to Home screen

8. Open MobileTerminal

• If you have not already done so, change the default password for Root which is "alpine" (security hazard). Type "login root" and password "alpine" and then "passwd" to change the password carefully (case-sensitive!)
• Do not exit MobileTerminal, leave your iPhone charging with the screen turned on in a safe place

Mac Section
1. Open System Preferences (click apple in top left)
2. Go to Network and write down the IP Address of the Computer, for this example I will use 192.168.1.2
3. Click Show All
4. Click Sharing
5. Enable "Remote Login", you should have an account with Administrator access (the main account) -- For this example we will use "sithu", replace this with your account's short name
6. Open Terminal (located in /Applications/Utilities)
7. We will now login into the iPhone from your Computer

• In the Terminal window, type the following commands exactly as below, case-sensitive, and being careful to keep the correct number and position of spaces. Replace with the IP address of your Phone.
  

  ssh [email protected]

• Press Enter, it may then ask you to type "yes" - do it.
• Enter password of "root" on your Phone, or if you didn't change it, type Alpine
• You are now "inside" your iPhone
• Next, verify that your phone can connect to your Computer via. SSH, type the following (replace with your account and computer's IP address)
  

  ssh sithu@192.168.1.2

• Enter "yes" if it asks you, then enter your Mac user's password (again, this should be an account with admin access)
• Once you successfully login, type

  exit

  to go back "inside" your Phone.
• Type the following 2 commands to make your user partition temporarily read-only:
  

  umount -f /private/var

  mount -o ro /private/var

• The next step will transfer an image file of the phone's internal disk to your computer (replace with your mac's ip address and account). It is extremely important that you do not mix up the "if" and the "of".
  

  dd if=/dev/rdisk0s2 bs=4096 | ssh sithu@192.168.1.2 'dd of=iphone_rdisk0s2_4096.img'

• (If this step doesn't work, try with bs=4096kb instead of bs=4096)
• Now enter your Mac user account's password
• Press Enter, and DO NOT TOUCH any other key, minimize or hide the terminal window.
  It will appear to be frozen for approximately 5-7 hours depending on your network speed, and capacity of iPhone.

8. Open a Finder window, and navigate to your account's Home Folder, you will see the file "iphone_rdisk0s2_4096.img" here. You can Command-I (get info) on the file to monitor the increase in size over time.
9. After a few hours, check your Terminal window to see if the transfer is finished.
10. You now have an image of the iPhone's disk which can be double-clicked and Mounted as a normal Mac disk image and its contents browsed in Finder (the other two threads I quoted above produced unmountable images). Its format is HFSX. However, what you are really interested in is the files that you cannot find -- the deleted / lost ones. For that go to the next section.


Data Recovery (PhotoRec) Section
0. Make sure you Eject your disk image if you mounted it!
1. Download the MAC version of PhotoRec (free) from here. It's a Terminal (command-line) program that recovers deleted files.
2. Unarchive the download, and find the "Darwin" folder-- it contains the program "photorec"
3. Rename the folder from Darwin to "Recovery" or some name without spaces
4. Move the "recovery" folder to your Applications folder
5. Open Terminal on your Mac, or open a New Window in terminal so that your current "location" in terminal will be your Home Folder.
6. In the terminal window, type the following and make sure you see the file "iphone_rdisk0s2_4096.img". It should be about 15,320,000,000 in size (15.3 gigs) for a 16gb iPhone.

ls -la

7. In the terminal window, type:

/applications/recovery/photorec iphone_rdisk0s2_4096.img

8. You should now be in the PhotoRec program. Here you can move the selection around using the arrow keys, and make selections by pressing Return.
9. Press Enter to choose your iphone_rdisk0s2_4096 disk image
10. Partition Table Type: None (Non-partitioned media)
11. Press Right arrow key, go to "File Opt", press Enter, and select/deselect the files you want to recover. For Photos and Videos, only select "jpg", "mov", "mpg". Choosing more than this will overwhelm you with useless files. (I didn't have much success in recovering my videos, maybe you will).
12. Press Enter to go back, now go to Other Settings

• Paranoid: No (this keeps corrupt jpg files)
• Allow partial cylinders: Yes
• Keep corrupt files: Yes
• Expert mode: No
• Low memory: No

13. Quit to previous menu
14. In the "Partition" list, press Down arrow key to select "HFSX" partition
15. Press Left arrow key to select "Search" and press Enter. Select "Other ...FAT/HFS/etc...."
16. On your Mac, create an Empty folder (maybe in Downloads) to store your recovered files.
17. In PhotoRec, navigate to this folder and press "Y" for yes- Read instructions at top carefully.
18. Your recovery process should have started, and you can see the files being saved to your folder if you open it in Finder. This took about 3-4 mins on a Mac Pro, and I was able to recover most of my images after being deleted accidentally.

Recover SMS or Call Records Database
1. Use PhotoRec as above, but when in File Opts choose only the file type "SQLite", deselect everything else. Running PhotoRec will produce a few thousand .sqlite files.
2. To find out which of the thousands of files is actually the SMS Database, download this program: Search File Contents
3. Download this program to open the sqlite files to see if it's the SMS database: SQLite Database Browser
4. Go to the recovered files, and delete all the large files over 10MB. It's unlikely that an SMS database, or call history would exceed this size. Large files will crash the program.
5. Install and run the Search File Contents program.
6. Go to Preferences, and add "sqlite" as a file type to search in File Searching section
7. Add the SQLite database browser as an application in the Opening files section
8. Point the program to the folder containing your recovered sqlite files, enter in Search For: "msg_group" and choose ASCII as encoding. Click Search For.
9. It'll find a couple files, one of them will be the SMS database. Select a file, choose "SQlite database browse" in Open File Using section at bottom. Click Open File.
10. This procedure can be repeated with different search strings for different types of databases, try "call_history_limit" for phone call history.

Other Tools
1. If you couldn't find your files using PhotoRec, you can try "Scalpel", the forensics tool -- I found this program recovered a few more files than PhotoRec, but crashed when using the rdisk0s2 image instead of the disk0 image in other threads. This requires you to have Xcode installed on your Mac so you can compile it.
2. iPhone Backup Extractor, allows you to extract files from your iTunes backups
3. DiskAid allows you to browse your iPhone over USB and transfer files back and fourth quite easily.


Hope this guide helps out some people. Feel free to contact me with corrections. It's a long post, but I think it's better to spell out each step. There is a method out there by Zdziarski (for law enforcement) which doesn't need jailbreaking, but it's really beyond me. Good luck!!

Sithu Win | sithuwin.com

Is the following type in the mac or the iphone

dd if=/dev/rdisk0s2 bs=4096 | ssh [email protected] 'dd of=iphone_rdisk0s2_4096.img'

[ctiffanie0708]

would this ever have any possibility that this would works on a Iphone 4??

[gmrnguyen]

any tutorials for window users?

[gmrnguyen]

I tried using the softwasre but my iphone doesn't show up.. only mt pc harddrive does. Any suggestions?

If you're a Windows Users,you can use this recovery software--Disk Doctors Photo Recovery for Win,you can free download and trial.

Use guide:

step1.connect iphone to computer

step2.open the software,and you can see iphone disk show on the software

step3.click "recover",and recover your deleted data on iphone.

[gmrnguyen]

Hello, I am in the process of using this guide and is having a slight issue with mobile terminal. I am running on a 4s ios 5.0.1 and mobile terminal isnt compatible with ios 4 or 5. Is there another way i can ssh into my mac?

[pwkelley7]

please help!

[hal2003]

hi together.
thanks for the tutorial!

the connection over ssh to my iphone is running.
the transfer is starting for a few minutes and the IMG has a few of megabytes (5MB - 50MB) and then the iphone makes a reset and starting.

can anyone help me please?
... and sorry for my bad english.