We’ve had our fairshare of unusual and difficult recoveries over the years, but I have to share a photo of this bent iPhone we recently recovered. It’s an iPhone 5s that has seen better days. I’d love to know how anyone could bend a phone that far without also smashing the screen! It’s impressive.
As always, my first concern was extracting the damaged Lithium battery. I removed that straight away and disposed of it before starting the recovery.
With a bit of TLC and a new battery and screen, the phone was just about working. It stayed working long enough to get an iTunes backup, and extract all the data.
I’ve previously written about the difficulties recovering data from modern iOS devices. This new post by Avast(!?) shows it from another angle. What happens when you sell an old device?
Because iOS uses hardware encryption on the main storage, recovery is almost impossible without the passcode. In contrast, Android phones (usually, by default) don’t encrypt the main storage. Also they allow external SD cards which may not be encrypted either. This means if an iPhone and an Android phone are sold or lost without being carefully erased, the iPhone will not easily give up the data but an android phone will. It also means if you forget your iPhone passcode you are unlikely to ever get the data back.
It’s a common problem that as we generate more data each year we start running out of space to put it. This is now even more of an issue in the smartphone market, where built-in cameras are generating increasingly large photos and videos, without providing much in the way of additional storage. The most common iPhones are still 16 & 32GB but the photos they now produce can be megabytes in size, with videos easily reaching 1GB.
It’s tempting to take that data and put it somewhere else, so either a laptop or external hard drive. Then once you’ve copied it all you delete it from the phone and gain back all that space. Problem solved.
Not So Fast…
If that copy on your laptop is now the only copy, then you could be one spilt coffee from disaster. If the laptop goes up in smoke, gets stolen, dropped or any of the myriad other ways of failing then it’s bye bye data.
The key to making backups is redundancy. The key to making backups is redundancy. The key to making backups is redundancy.
You need to make extra copies of your data to different types of storage. This could be an external hard drive, NAS, USB Pen, SD card, anything. But don’t just pick one of those. Make a few backups. Put one in a locked safe somewhere. Send photos off to the cloud. Store a copy of your music at your nan’s house. If any of those copies gets lost or broken you can just replace it with another copy.
So let’s run through an example. All those photos on your iPhone have filled it up. Here’s what I would do:
Copy the photos to my computer. Check them.
Backup the computer as usual. (You’re already doing that, right?)
Make another backup, or copy the photos to an online storage service like Dropbox.
Now it is safe to delete the photos from the iPhone and revel in all that fresh space.
Note: Deleted photo recovery is virtually impossible for all modern iPhone versions due to encryption.
Here’s another example for when your computer runs out of space instead:
Is it possible to upgrade the internal storage? If it is then you should do that.
If this is not possible, or too expensive then you will have to get creative. It will be more fiddly but copy all data to two external hard drives.
You always want to avoid just leaving your data in one place. All electronic devices can (and will) fail, and they have a terrible habit of doing so at the worst possible moment.
So, just remember that no single copy of your files are safe. Making extra copies is cheaper and easier than waiting until something fails.
When we recover iPhones, although we can usually provide the data in a computer-readable format, it is often easier to just load the data back onto another iPhone. Fortunately, as long as you restore the data in the correct order, you should get your iPhone up and running with your restored data.
Before you attach the iPhone you need to make sure iTunes is ready for it. You need to put the recovered iPhone backup into the correct place for iTunes to find. Quit iTunes first.
The iPhone backups go into:
C:\Documents and Settings\username\Application Data\Apple Computer\Mobile Sync\Backup
Now copy your iPhone backup folder from the recovered data to the backup folder on the computer. If you’ve ever made any iPhone backups they will be in this folder with long unreadable names of random numbers and letters. It doesn’t matter that you can’t read it, iTunes can. Don’t rename it!
So now your /MobileSync/Backup folder should look something like:
Remember that the string of numbers will not be the same.
Next you can launch iTunes and see if the iPhone backup is seen in the list. Within iTunes select Preferences and then the Devices tab (Image Below). If your backup file has been recognised then you should see the iPhone name in the list and the date of the backup. If not, go back and check that everything is in the right place.
Next, it’s a good idea to sign in to the iTunes Store. If you’ve not used this computer with this iPhone before you may also need to authorise the computer to access your purchased apps and media. Once signed-in to the store you should choose the Store menu and select “Authorise This Computer…” Be aware that you can only authorise a set number of computers. (The limit can be reset if needed.)
Now you can import the Music and apps into iTunes. Don’t worry if some of the apps don’t have icons yet.
Once all that is finished you are ready to connect the new iPhone. You will need to follow some on-screen prompts and settings, and then it will ask if you want to set it up as a new device, or restore it from a backup. This is where all that hard work pays off. Choose the backup, and let iTunes work its magic. It can take a while if you have lots to restore but when it’s finished your phone should boot into a familiar screen. Your Contacts, Messages, Calendars, Notes and lots of other data will be back in their respective apps.
If none of the other apps got transferred you can choose the Apps tab within iTunes and tick “Sync Apps.” You can then tick whichever apps you want to send to the iPhone.
When developing our iPhone data recovery process we had to make a few decisions about the devices we can support. The newer iPhones (4s +) are not accessible in the same way as older models.
With the iPhone 4 and below we can extract the data using a forensically clean process. What this means is that we can take the data off without writing anything to the NAND chips (storage) inside the iPhone. This fits in perfectly with our regular data recovery process as we never write data to a device we receive.
With the iPhone 4s, Apple changed the part of the system we use to access the iPhone’s memory. There is a chance that a new method of extraction for iPhone 4s will become available, but until it does we will not be recovering files from these devices.
iPhones store their data on NAND chips which are soldered to the main circuit board of the phone. The data can only be correctly decoded if we also have access to other parts of the circuit board, so it is crucial that the iPhone is electronically functional. If water damage has shorted the iPhone then we have no way to access the data externally. It’s not that it’s impossible, just that the work would be unreasonably expensive and time consuming.
Another potential barrier for iPhone recovery is down to the way files are stored. Since iOS4 most files including iPhone camera photos and videos are encrypted before being written to storage, using unique encryption keys. This means every file ends up with a different header. When files are deleted there is nothing to distinguish a photograph from any other random collection of bytes.
Another problem with the file based encryption is that if you restore the iPhone using iTunes, those encryption keys get erased and new ones are generated. This prevents recovery of the old data, which is good for security but bad for data recovery.