Guide: Recover Lost or Deleted Photos/Files on iPhone 3G/S (Jailbroken) on a Mac

[siethoo]

This is a Step-by-Step Guide specifically for Mac users to recover accidentally deleted or lost photos/videos or any file directly from the disk of an iPhone 3G/3GS without a recent sync or iTunes backup.

I felt the need to post a Mac-centric guide, and would like to credit the posters of two similar threads (HOW TO: iPhone Data Recovery and Recovering Lost/Deleted Data From An iPhone That Has Not Been Backed Up) as well as Jonathan Zdziarski and VIAForensics.


This method requires a functioning Jailbroken iPhone, low-moderate skill level, and approximately 5-7 hours. If you have deleted files from your Phone, it's important that you don't record more photos/videos or download large files to the phone which may "overwrite" the lost files forever. Use your phone as little as possible.


My Setup
iPhone 3G (3.0) and iPhone 3GS (3.1) - Both Tested Ok
Mac OS X Snow Leopard 10.6.2
A home wireless WiFi Network with both iPhone and Computer on same Network


iPhone Section
1. You will need a Jailbroken iPhone (see iClarified guide)
2. You will need Cydia installed on your iPhone (installed during Jailbreak)
3. Open Cydia
4. Install two programs: Mobile Terminal, and OpenSSH
5. Power Off and On the iPhone
6. Find the IP Address of your iPhone on your Local Network (iClarified)

• Open Settings
• Click Wi-Fi
• Press the Blue circled arrow beside your network's name
• Write down the Phone's IP Address (for this example, I will use 192.168.1.3)

7. Go Back to main Settings screen

• Click Carrier and choose another carrier (or power off and take out your SIM card) so you don't get calls in the process.
• Turn your Brightness down to about 10%
• Plug your Phone into a Wall Charger
• Click "General" and set "Auto-Lock" to "Never" (older software versions may not have this setting, in which case you may have to manually prevent your phone from going to sleep for 5 hours, ouch)
• Exit to Home screen

8. Open MobileTerminal

• If you have not already done so, change the default password for Root which is "alpine" (security hazard). Type "login root" and password "alpine" and then "passwd" to change the password carefully (case-sensitive!)
• Do not exit MobileTerminal, leave your iPhone charging with the screen turned on in a safe place

Mac Section
1. Open System Preferences (click apple in top left)
2. Go to Network and write down the IP Address of the Computer, for this example I will use 192.168.1.2
3. Click Show All
4. Click Sharing
5. Enable "Remote Login", you should have an account with Administrator access (the main account) -- For this example we will use "sithu", replace this with your account's short name
6. Open Terminal (located in /Applications/Utilities)
7. We will now login into the iPhone from your Computer

• In the Terminal window, type the following commands exactly as below, case-sensitive, and being careful to keep the correct number and position of spaces. Replace with the IP address of your Phone.
  

  ssh [email protected]

• Press Enter, it may then ask you to type "yes" - do it.
• Enter password of "root" on your Phone, or if you didn't change it, type Alpine
• You are now "inside" your iPhone
• Next, verify that your phone can connect to your Computer via. SSH, type the following (replace with your account and computer's IP address)
  

  ssh sithu@192.168.1.2

• Enter "yes" if it asks you, then enter your Mac user's password (again, this should be an account with admin access)
• Once you successfully login, type

  exit

  to go back "inside" your Phone.
• Type the following 2 commands to make your user partition temporarily read-only:
  

  umount -f /private/var

  mount -o ro /private/var

• The next step will transfer an image file of the phone's internal disk to your computer (replace with your mac's ip address and account). It is extremely important that you do not mix up the "if" and the "of".
  

  dd if=/dev/rdisk0s2 bs=4096 | ssh sithu@192.168.1.2 'dd of=iphone_rdisk0s2_4096.img'

• (If this step doesn't work, try with bs=4096kb instead of bs=4096)
• Now enter your Mac user account's password
• Press Enter, and DO NOT TOUCH any other key, minimize or hide the terminal window.
  It will appear to be frozen for approximately 5-7 hours depending on your network speed, and capacity of iPhone.

8. Open a Finder window, and navigate to your account's Home Folder, you will see the file "iphone_rdisk0s2_4096.img" here. You can Command-I (get info) on the file to monitor the increase in size over time.
9. After a few hours, check your Terminal window to see if the transfer is finished.
10. You now have an image of the iPhone's disk which can be double-clicked and Mounted as a normal Mac disk image and its contents browsed in Finder (the other two threads I quoted above produced unmountable images). Its format is HFSX. However, what you are really interested in is the files that you cannot find -- the deleted / lost ones. For that go to the next section.


Data Recovery (PhotoRec) Section
0. Make sure you Eject your disk image if you mounted it!
1. Download the MAC version of PhotoRec (free) from here. It's a Terminal (command-line) program that recovers deleted files.
2. Unarchive the download, and find the "Darwin" folder-- it contains the program "photorec"
3. Rename the folder from Darwin to "Recovery" or some name without spaces
4. Move the "recovery" folder to your Applications folder
5. Open Terminal on your Mac, or open a New Window in terminal so that your current "location" in terminal will be your Home Folder.
6. In the terminal window, type the following and make sure you see the file "iphone_rdisk0s2_4096.img". It should be about 15,320,000,000 in size (15.3 gigs) for a 16gb iPhone.

ls -la

7. In the terminal window, type:

/applications/recovery/photorec iphone_rdisk0s2_4096.img

8. You should now be in the PhotoRec program. Here you can move the selection around using the arrow keys, and make selections by pressing Return.
9. Press Enter to choose your iphone_rdisk0s2_4096 disk image
10. Partition Table Type: None (Non-partitioned media)
11. Press Right arrow key, go to "File Opt", press Enter, and select/deselect the files you want to recover. For Photos and Videos, only select "jpg", "mov", "mpg". Choosing more than this will overwhelm you with useless files. (I didn't have much success in recovering my videos, maybe you will).
12. Press Enter to go back, now go to Other Settings

• Paranoid: No (this keeps corrupt jpg files)
• Allow partial cylinders: Yes
• Keep corrupt files: Yes
• Expert mode: No
• Low memory: No

13. Quit to previous menu
14. In the "Partition" list, press Down arrow key to select "HFSX" partition
15. Press Left arrow key to select "Search" and press Enter. Select "Other ...FAT/HFS/etc...."
16. On your Mac, create an Empty folder (maybe in Downloads) to store your recovered files.
17. In PhotoRec, navigate to this folder and press "Y" for yes- Read instructions at top carefully.
18. Your recovery process should have started, and you can see the files being saved to your folder if you open it in Finder. This took about 3-4 mins on a Mac Pro, and I was able to recover most of my images after being deleted accidentally.

Recover SMS or Call Records Database
1. Use PhotoRec as above, but when in File Opts choose only the file type "SQLite", deselect everything else. Running PhotoRec will produce a few thousand .sqlite files.
2. To find out which of the thousands of files is actually the SMS Database, download this program: Search File Contents
3. Download this program to open the sqlite files to see if it's the SMS database: SQLite Database Browser
4. Go to the recovered files, and delete all the large files over 10MB. It's unlikely that an SMS database, or call history would exceed this size. Large files will crash the program.
5. Install and run the Search File Contents program.
6. Go to Preferences, and add "sqlite" as a file type to search in File Searching section
7. Add the SQLite database browser as an application in the Opening files section
8. Point the program to the folder containing your recovered sqlite files, enter in Search For: "msg_group" and choose ASCII as encoding. Click Search For.
9. It'll find a couple files, one of them will be the SMS database. Select a file, choose "SQlite database browse" in Open File Using section at bottom. Click Open File.
10. This procedure can be repeated with different search strings for different types of databases, try "call_history_limit" for phone call history.

Other Tools
1. If you couldn't find your files using PhotoRec, you can try "Scalpel", the forensics tool -- I found this program recovered a few more files than PhotoRec, but crashed when using the rdisk0s2 image instead of the disk0 image in other threads. This requires you to have Xcode installed on your Mac so you can compile it.
2. iPhone Backup Extractor, allows you to extract files from your iTunes backups
3. DiskAid allows you to browse your iPhone over USB and transfer files back and fourth quite easily.


Hope this guide helps out some people. Feel free to contact me with corrections. It's a long post, but I think it's better to spell out each step. There is a method out there by Zdziarski (for law enforcement) which doesn't need jailbreaking, but it's really beyond me. Good luck!!

Sithu Win | www.sithuwin.com

[h479]

how to I do tht on windows? Windows doesnt have terminal right?

Thanks!

[AbrasBR]

Hi. I have a 3GS 3.1.2 and a Snow Leopard 10.6.2. I got 2 problems.
First if i try to do
"umount -f /private/var" I get, -sh: umount: command not found.

Then, if I skip this command, and go to "dd if=/dev/rdisk0s2 bs=4096 | ssh [email protected] 'dd of=iphone_rdisk0s2_4096.img" i get this:

dd: reading `/dev/rdisk0s2': Invalid argument
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000557 s, 0.0 kB/s
Password:
0+0 records in
0+0 records out
0 bytes transferred in 0.001643 secs (0 bytes/sec)

and it creates a 0kb file on my mac. Could you please help me?Thanks

[Spets]

its not unmount, its umount and i have the same problem as far as the iphone not dumping the image, keeps coming back as:

dd: reading `/dev/disk0': Invalid argument
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000527 s, 0.0 kB/s

im thinking bad hard drive, any thoughts? i know i saw some posts with access denied, but this is different, it lets you go there but wont do it. please help, lost my pictures from my recent trip.

Thanks,
Spets

Ps. is there anyway to get photorec to run straight off the iphone, found something called ifuse but doesnt seem to work like its suppose to, let me know thanks.

[Iren23]

I have used a program Photo File Recovery.

Google it, think there is a free trial on their website.

I have only used it once so am not to clued up on how the software fully functions.

[siethoo]

h479 -- This article is tailored for Mac users. There are two threads I linked at the start of the article that you could check out.

AbrasBR and Spets: Have you installed both the MobileTerminal, and OpenSSH packages through Cydia? Also AbrasBR, please make sure you aren't using 'sithu' as your login for your Mac. This should be your user name. I'm not really an expert at this stuff, I just managed to get it to work with this particular sequence... Can only suggest that you make sure each step is followed in order... Let me know in more detail what point in the process you were successful at, and what point you got stuck.

[belbo]

I have had the same response as Abras and Spets...
the command says /dev/disk0 is an "invalid argument" and everything has a value of zero.

I've tried several times, using variations on the instructions posted here as well as in other threads.
It would be really great to get access to pictures that were lost after a recent problem with my phone.

I'm using a 3GS 32gb, connecting to a MBP running Snow Leopard.

Any help would be much appreciated
I'm holding off restoring my phone until I can attempt to get my recent images back.

***EDIT***

It worked finally!

Many hours of fiddling.
The answer for me came from another thread, where someone suggested to put
bs=1M in the dd script.

I tried that and it kept failing after a few hundred meg, but then I used Seithoo's bs=4096 with an added KB after it:
bs=4096KB

and ten hours later, I had an image of my 3Gs.

Just ran Photorec and recovered over 2,000 images/movies. Now all I need to do is sort through them to find the ones that weren't backed up : )

thanks to everyone who contributed to this issue.

[siethoo]

Belbo, great to hear it worked out for you! -- I've added a note on your discovery. Cheers

[hi-tech]

Hi,

Thx for this great tutorial i succesfully recovered a couple of photos i needed. But i don't know how to recover my sms database. "sms.db" how is this possible.

Hi-Tech

[siethoo]

hi-tech,

Please see the added section at the bottom of the guide. This should help you out. Sorry I can't explain further the usage of sqlite browser or how to put the database back into the phone. This info can be easily googled.

Cheers.

[hi-tech]

hi,

i recovered the sql file with my sms.db and can read it with sqlbrower but no i don't know how to convert the .sqlite file to .db

tried export but no can do.

any one got some experience with this? thx greetz

[siethoo]

hi-tech, just rename the file to "sms.db" ... No need to convert it. Copy it over to the correct folder using the "Diskaid" program at bottom of guide.

[maftei]

Hello siethoo, and congratulations for this guide.

I followed step by step and almost got it done until the connection terminated at 10gb image size.
I think it was the iphone's fault because after this i tried to exit terminal and got jammed in the home screen with the loading "wheel" spinning. I had to do a hard reset (power + home button same time).

Do you have any advice before me trying the procedure again? Maybe the iphone got hot?

Thank you,
Mihnea

LE: I also used photorec to see if i can recover some jpgs and i got many screenshots of the iphone screen (power + home button pressed at the same time) that were not previously in iphone.
Also many duplicates with 55X55 and 75X75 resolution.

[maftei]

Got it working entering Settings>Wi-Fi, thus making the iphone keep some activity..
Thank you

[sliff101]

alright so ive been able to do the image file transfer and all but i am curious to how i can make my iphone 3gs have read and write permission again, now when i connect my iphone and open itunes it says i have 13gbs of "other" (orange) which i know is that there, and when i go preferences.app general-about it says available space: zero kb and i had around 9gb's before i entered the read only commands.

so if anyone could help me here that would be great

much thanks

[gcool]

hello
my iPhone disk has another descriptor.
in fact it is /dev/disk0s2s1
to find it just run the "mount" command and look where /private/var is.

Then, in the DD command use if=/dev/rdisk0s2s1 bs=4096KB

don't forget the 'r' before the 'disk0....'

Also - making the /private/var read only gave me issues and crashes so i ignored that part

iPhone is dumping as we speak.....

cheers

[Free Lancer]

Trying to recover data off my Iphone 3GS to MAC VM and I tried using this guide However, I um unable to run DD as I cannot get the filesystem to umount or mount as read only and I keep getting 'Resourse Busy' error. Please see my logs here:

localhost:~ root# df -kh
Filesystem Size Used Avail Use% Mounted on
/dev/disk0s1 750M 497M 246M 67% /
devfs 28K 28K 0 100% /dev
/dev/disk0s2s1 15G 142M 15G 1% /private/var

localhost:~ root# dd if=/dev/disk0s2s1 bs=4096 | ssh [email protected] 'dd of=iphone_reclaim.img'
dd: opening `/dev/disk0s2s1': Resource busy

Password:
0+0 records in
0+0 records out
0 bytes transferred in 0.000035 secs (0 bytes/sec)


localhost:~ root# dd if=/dev/disk0s2s1 bs=1M | ssh [email protected] 'dd of=iphone_reclaim.img'
dd: opening `/dev/disk0s2s1': Resource busy


localhost:~ root# mount -o ro /private/var
mount_hfs: Resource busy

localhost:~ root# mount -o ro force /private/var
force on /private/var: Operation not supported by device
localhost:~ root#


I downloaded umount from somewhere and scp'd it to Iphone:

MacAdmin$ scp ~/Desktop/Iphone\ FW/umount [email protected]:/sbin/
[email protected]'s password:
umount 100% 15KB 14.6KB/s 00:00

localhost:~ root# umount -f /private/var
Killed
localhost:~ root# mount -o ro /private/var
mount_hfs: Resource busy


Might go bald pulling my hair......any help? How is the rest of world doing this?

[gcool]

@freelancer
if=/dev/rdisk0s2s1
don't forget the 'r'

@freelancer
mounting /private/var as read-only gave me issues and crash. I did not do it

[onelife]

Hi you are a LEGEND!!

i have been successful before with this process recovering images. I wanted to know if its possible to recover notes and voice recordings using this method? If not what are my options?

[gentoox86]

I got both dd images off for root and user but using photo rec and other programs I cannot get my photos or movie files off the iphone. I got 2 images that I put on before the first jailbreak and then nothing after that.. has anyone else had that trouble.
Snow Leopard + 3.1.3 3GS
Thanks