Jump to content

linux file recovery, hfs file system? iphone 5


i8igmac
 Share

Recommended Posts

we recently had a employee quit and factory reset his phone. I need to recover photos from this phone for work related purposes.

a quick Google search I found hfsprecover which seems like a Linux tool for recovering data from HFS file systems?

has anyone attempted file recovery 'the linux method' on a Mac or iPhone before any suggestions for tools?

the cloud is not an option and I have already scanned the database files and found nothing

Link to comment
Share on other sites

I don't own, never held a iphone or mac...

Why is this hard drive different from others?

My understanding of file recovery in lamme terms...

When a file is deleted, that section of hard drive space is now available for a rewrite... the data still exist and can be recovered until that section has been over written...

Edited by i8igmac
Link to comment
Share on other sites

Since we are specifically focused on the iPhone:

Ever since the A5 chip, the storage on the phone has been encrypted. Each file on the phone is encrypted with it's own key. Once the file is deleted, it is marked as unallocated to the file system, and the encryption key is deleted as well. There is no way to recover said photos that were deleted unless they are in the "Recently Deleted", on iCloud, or were sent in an MMS/iMessage and the message is still there.

You are correct with your understanding, but things change a bit for mobile devices.

Link to comment
Share on other sites

You cannot crack these keys because you would be unable to recover them. Even if you jailbreak the device, you can only get a logical copy of allocated information since it is all encrypted. So the only way that you will get those pictures is if they are in the "Recently Deleted", on iCloud, or were sent in an MMS/iMessage and the message is still there.

Link to comment
Share on other sites

Why would they do that lol

And what about cracking these keys?

So it seems that these files can be recovered, but it would be a bunch of encrypted junk.

It's this funny little thing called SECURITY! All phones devices should do this by default, but they don't, yet.

Edited by barry99705
Link to comment
Share on other sites

  • 5 months later...
Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...