i8igmac Posted August 11, 2015 Share Posted August 11, 2015 we recently had a employee quit and factory reset his phone. I need to recover photos from this phone for work related purposes. a quick Google search I found hfsprecover which seems like a Linux tool for recovering data from HFS file systems? has anyone attempted file recovery 'the linux method' on a Mac or iPhone before any suggestions for tools? the cloud is not an option and I have already scanned the database files and found nothing Link to comment Share on other sites More sharing options...
Mr-Protocol Posted August 11, 2015 Share Posted August 11, 2015 What model iPhone and iOS version is on the device? Do you know the account login/password to pull iCloud data? That would probably be the only way to get any of those pictures back. Link to comment Share on other sites More sharing options...
i8igmac Posted August 11, 2015 Author Share Posted August 11, 2015 I just spoke with the employee. he never used any iTunes or iCloud. I hope for a method like linux safecopy exist type of harddrive... waiting on the modle number... its iphone 5 Link to comment Share on other sites More sharing options...
i8igmac Posted August 12, 2015 Author Share Posted August 12, 2015 iPhone 5c Link to comment Share on other sites More sharing options...
Mr-Protocol Posted August 12, 2015 Share Posted August 12, 2015 There is nothing you can do. You would be lucky if you found a thumbnail lurking about. If the company owns the device and the login for it, might be able to restore from iCloud backup. Other than that, the pictures are gone. Link to comment Share on other sites More sharing options...
i8igmac Posted August 12, 2015 Author Share Posted August 12, 2015 (edited) I don't own, never held a iphone or mac... Why is this hard drive different from others? My understanding of file recovery in lamme terms... When a file is deleted, that section of hard drive space is now available for a rewrite... the data still exist and can be recovered until that section has been over written... Edited August 12, 2015 by i8igmac Link to comment Share on other sites More sharing options...
Mr-Protocol Posted August 12, 2015 Share Posted August 12, 2015 Since we are specifically focused on the iPhone: Ever since the A5 chip, the storage on the phone has been encrypted. Each file on the phone is encrypted with it's own key. Once the file is deleted, it is marked as unallocated to the file system, and the encryption key is deleted as well. There is no way to recover said photos that were deleted unless they are in the "Recently Deleted", on iCloud, or were sent in an MMS/iMessage and the message is still there. You are correct with your understanding, but things change a bit for mobile devices. Link to comment Share on other sites More sharing options...
i8igmac Posted August 12, 2015 Author Share Posted August 12, 2015 Why would they do that lol And what about cracking these keys? So it seems that these files can be recovered, but it would be a bunch of encrypted junk. Link to comment Share on other sites More sharing options...
Mr-Protocol Posted August 12, 2015 Share Posted August 12, 2015 You cannot crack these keys because you would be unable to recover them. Even if you jailbreak the device, you can only get a logical copy of allocated information since it is all encrypted. So the only way that you will get those pictures is if they are in the "Recently Deleted", on iCloud, or were sent in an MMS/iMessage and the message is still there. Link to comment Share on other sites More sharing options...
barry99705 Posted August 12, 2015 Share Posted August 12, 2015 (edited) Why would they do that lol And what about cracking these keys? So it seems that these files can be recovered, but it would be a bunch of encrypted junk. It's this funny little thing called SECURITY! All phones devices should do this by default, but they don't, yet. Edited August 12, 2015 by barry99705 Link to comment Share on other sites More sharing options...
Mr-Protocol Posted January 26, 2016 Share Posted January 26, 2016 It's an iPhone 5C that has been factory wiped. Other than iCloud data or backups made to the computer, there is no way to recover information. Closed. Link to comment Share on other sites More sharing options...
Recommended Posts