pm sent!

I have recovered data from all iphones, ipads, deleted etc. I have had an extremely high recovery rate even after people performing restores onto the phone.

What i have found is:

recovery probability so far:
text messages and attachments: high
photos: high
incoming / outgoing call list: high
contacts: high
apps and data within apps: medium
browsing history: low
autocomplete library: low
crash logs: high

So far I have not encountered anyone who has the ability to recover deleted test messages from newer generation I-phones (4, 4s, etc..) Yes sometimes some messages are marked as deleted in the sms.db, but they still remain in the sqllite database. Not referring to that, but rather to truly deleted messages that are no longer part of the database and FS. You can do this?

Well you have encountered someone because i have done it. I have done it on my iphone 4 gsm model after a full restore. I get clients who have upgraded to ios 6 and blown all the info out, recovered. deleted photos and text message attachments are no problem.

I have no recovered from a NON-Working as in BLOWN motherboard yet via the chips yet. (haven't bothered due to low low request for it)

I think we are talking about two different thing here. But thank you for your feedback, it's appreciated.

As a followup, I did manage to recover a few pictures using Cellebrite. This is a fine piece of software, really.
Gave them to my friend and she was more than happy

Ah, I love happy endings...

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Hi Northwind, which product did you use?

I used Cellebrite's Physical Analyzer. Fantastic product.

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

Actually, there is a few solutions out there for iPhones, however, the 4S an upwards connot be physically imaged just yet.

It should be possible to create a physical image of a 3GS and either use a tool such as EnCase (not free) or FTK Imager (free) to export the files, if they have been deleted, you can simply carve the photo's from the image.

I am led to believe that if the ipone has been 'reset', the crypto keys have been destroyed and therefore legacy data cannot be recovered.

This is one of the tools that we use: http://www.forensicts.co.uk/SubCategory ... 7&SMID=100

There is also a free version that we used to use before iXam, however, it is only available to Law Enforcement.

This version is maintained by Jonathan Zdziarski - http://www.zdziarski.com/blog/?cat=11

Northwind, where are you located as we do have the tools to image that particular iPhone and I would be more than happy to get one of my colleagues to do the extraction for free (BTW I'm not in NZ! - just trying to be anonymous due to my job! - PM me).

Also I have a problem which I have posted here that I am looking for an answer to: recover-adaptive-information-from-service-area-t24575.html

Needless to say the circumstances surrounding my problem are not entirely as I've described, but I could discuss a little more in depth through PM.

Thanks,

J.

I think your question was addressed to someone else maybe, not me, since I have succesfully closed the case and my whereabouts are visible on my signature. But, thanks anyway!

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners

northwind, Yes the message was for you, but as I am a new user, my post was delayed as it had to be previewed by a moderator first.

I did notice that your location was Greece, however, your excellent use of the English language led me to believe that you may actually be in an English speaking country!

J.

Thanks for the kind words. No, we're based in Greece.

Again, thanks for the offer, but this case closed with success, so I do not need any additional help with this

_________________
http://www.northwind.gr
SandForce SSD Recovery
Ransomware Reverse Engineering - NoMoreRansom! partners