iPhone Data Recovery – Obstacles

Hardware

iPhone Data Recovery
iPhone Data Recovery

When developing our iPhone data recovery process we had to make a few decisions about the devices we can support. The newer iPhones (4s +) are not accessible in the same way as older models.

With the iPhone 4 and below we can extract the data using a forensically clean process. What this means is that we can take the data off without writing anything to the NAND chips (storage) inside the iPhone. This fits in perfectly with our regular data recovery process as we never write data to a device we receive.

With the iPhone 4s, Apple changed the part of the system we use to access the iPhone’s memory. There is a chance that a new method of extraction for iPhone 4s will become available, but until it does we will not be recovering files from these devices.

Physical damage

iPhones store their data on NAND chips which are soldered to the main circuit board of the phone. The data can only be correctly decoded if we also have access to other parts of the circuit board, so it is crucial that the iPhone is electronically functional. If water damage has shorted the iPhone then we have no way to access the data externally. It’s not that it’s impossible, just that the work would be unreasonably expensive and time consuming.

Deleted Files

Another potential barrier for iPhone recovery is down to the way files are stored. Since iOS4 most files including iPhone camera photos and videos are encrypted before being written to storage, using unique encryption keys. This means every file ends up with a different header. When files are deleted there is nothing to distinguish a photograph from any other random collection of bytes.

Another problem with the file based encryption is that if you restore the iPhone using iTunes, those encryption keys get erased and new ones are generated. This prevents recovery of the old data, which is good for security but bad for data recovery.

 

The Little-Big Drive

Toshiba has just announced the 1.8″, 160GB, 5400rpm MK1617GSG drive. Apparently designed for netbooks and other such small machines, it’s a shame that this drive is a tad on the bulky side. at 8mm thick, this drive would be bulging out the sides of a current iPod or MacBook Air. With a SATA interface though, this drive could make for some fun embedded type devices or mods. I would personally love to see one squashed into an eeepc. I also bet that this little baby will be far cheaper than an equivalent solid state drive.

Samsung to release 1.3 inch drive in January

Apparently set to be unveiled at CES in January, this little baby is aimed squarely at “mobile consumer devices.” Whether that means some next-gen iPods or maybe even phones is anyones guess. Also no mention of capacity on these drives yet. (I love the cat picture in the original article too.)

Read On Engadget

Toshiba Announce 240GB 1.8″ Drive

Toshiba DTR vs PMR
Toshiba DTR vs PMR

Toshiba announced some breakthroughs in magnetic storage that could theoretically see the 1.8″ hard drives pushing 240GB using two platters. Using a new process which adds grooves to the disc surface, Toshiba have been able to get 120GB per platter. Apparently this process is best suited to small drives such as 1.8″ & 2.5″ drives. Although this would mean a nice fat drive in our iPod, this process is expected to reach the manufacturing process in 2009.

How to Fix a 5G iPod When it Starts Skipping Tracks

A simple way to fix a skipping iPod 5G
A simple way to fix a skipping iPod 5G

We recently received a white 5G iPod for repair. The problem with this iPod seemed fairly simple. After loading tracks from a windows version of iTunes, the songs would appear in the list as usual, but after playing one or two songs the iPod would stop playing and appear to skip through the rest of the songs. We have seen this sort of issue before, when songs have gone into the iTunes Library but never copy correctly over to the iPod. We confirmed that this was not the case as we were using a fresh iTunes install with only one album in the library.

 

Another issue we see is when the iPod’s system area becomes corrupt and therefore causes problems playing music. We removed the Toshiba hard drive from the iPod and performed a complete write process on the drive to remove all partition and data information. As a matter of interest we decided to restore the iPod on a Macintosh computer. When we added the sample songs, all was good. They played correctly and we thought problem solved. We had to restore the iPod on a Windows PC to give back to the customer, so we carried out the restore and added some sample tracks. Unexpectedly we were back in the same situation again. The songs would initially start to play but then skip around all over the place. Next on our list of possible fixes were iPod diagnostic modes. These are accessed on this iPod using the following process:

  1. Toggle hold switch on (red) then off (white)
  2. Hold down the menu and center (select) button for a few seconds to reset the iPod
  3. Once the white apple logo appears, press and hold center (select) button and previous (<<) button
  4. From this secret menu we tried a full test (be aware that testing the SDRAM took around 20-30 minutes and shows no activity until it is finished)

These test all passed with flying colours so it was back to the drawing board. Thinking back to the fact that the iPod worked fine when it was Macintosh formatted we decided to try a firmware downgrade. All we had to do was choose a firmware from the list and load it onto our iPod. We tried 2005-11-17 which contains firmware version 1.0 for the 5G iPods. We did have to plug the iPod into the PC and then eject it from the taskbar before the restore utility would work.

Since downgrading the iPod it has worked flawlessly and been playing music non-stop. Apple appears to be ignoring this problem instead of providing an update or even recommending this downgrade option. Hopefully this little guide will save a few iPods from the scrap heap and maybe even provoke a response from the big A. We will have to wait and see what Firmware 1.3 brings.

Samsung Start Manufacture of 64GB 1.8" SSDs

Samsung has today started production of it’s 64GB solid state drive. (How long until we see that in an iPod hack?…) These 1.8″ flash hard drives would be a welcome addition to any portable device, provided you keep regular backups. At least if the drives do fail you won’t have to put up with the heart wrenching click of death. (but good luck trying to desolder and then resolder all those chips in an ill-fated and expensive data recovery attempt.)

Read More On Engadget

PNY unveils SSDs for laptops, iPods and more

Engadget today posted news of the new solid state disks from PNY. In 1.8″ and 2.5″ flavours they feature 66MB/s read and 55MB/s write speeds with standard ZIF, Micro SATA, 44-pin IDE and SATA interfaces. These drives will be simple replacements for laptops and will eventually (by the end of the year) be shipping 1.8″ and 2.5″ drives up to 128GB capacity. Finally my whole music collection can follow me to the gym without fear of trashing the 1.8″ drive and it’s glass platters! It is now more important than ever that people start to put a decent backup routine in place because with solid state storage there is not much a data recovery company can do to resurrect them when they fail.

Read More On Engadget

Head Crash on 1.8″ 60GB Toshiba ZIF Hard Drive

 

We received an iPod containing a Toshiba MK6008GAH 1.8″ drive for data recovery recently. The iPod was rattling when inspected so we thought the ipod itself may have been broken. Upon removing the drive we observed that the rattle noise was in fact coming from inside the tiny drive.

More than a head crash with this drive
More than a head crash with this drive

We checked if the client wanted us to move into the cleanroom phase of recovery which is more expensive. The client said yes and so we took the drive in for its diagnosis.

After removing the cover the level of damage was very clear. The top disk platter was completely shattered leaving no chance of recovery. The other intact disk was scratched to pieces by the loose fragments of glass that were knocking around inside the drive enclosure. The read/write mechanism had not even left the ramp as you can see in the photographs although it would be clearly contaminated by the glass dust.

Looking at the severity of the damage it is difficult to understand the reasoning behind using glass disks inside such a portable hard drive. We do not know how much shock caused the disk to shatter but the fact that it is possible at all seems strange.