Actually, there is a few solutions out there for iPhones, however, the 4S an upwards connot be physically imaged just yet.
It should be possible to create a physical image of a 3GS and either use a tool such as EnCase (not free) or FTK Imager (free) to export the files, if they have been deleted, you can simply carve the photo's from the image.
I am led to believe that if the ipone has been 'reset', the crypto keys have been destroyed and therefore legacy data cannot be recovered.
This is one of the tools that we use:
http://www.forensicts.co.uk/SubCategory ... 7&SMID=100There is also a free version that we used to use before iXam, however, it is only available to Law Enforcement.
This version is maintained by Jonathan Zdziarski -
http://www.zdziarski.com/blog/?cat=11Northwind, where are you located as we do have the tools to image that particular iPhone and I would be more than happy to get one of my colleagues to do the extraction for free (BTW I'm not in NZ! - just trying to be anonymous due to my job! - PM me).
Also I have a problem which I have posted here that I am looking for an answer to:
recover-adaptive-information-from-service-area-t24575.htmlNeedless to say the circumstances surrounding my problem are not entirely as I've described, but I could discuss a little more in depth through PM.
Thanks,
J.