Need iPhone data recovery

[Rick Cole]

Summary: My customer dropped her iPhone 4 into the water and needs her pictures recovered.

Symptoms: When you plug it into iTunes- it says it is locked with a passcode. We have the passcode, however, we cannot enter the passcode because neither the digitizer or LCD works. Replacing the screen did not help and there is visible corrosion on the logic board around the LCD connectors.

My guess is that the only way to recover the data would be to rework the NAND chip into another iPhone. Send me a message with a quote if you're up for the job.

-Rick

[loki]

If you used Icloud or Itunes to back up it might be cheaper just to buy a new or second hand Iphone & then restore the backup during setup?
iphone data recovery is going to be expensive.

[hddguy]

My guess is that the only way to recover the data would be to rework the NAND chip into another iPhone.

Not even sure this is a viable option. Mostly the iPhones are encrypted, I would assume the key is unique and based on some hardware linked to the original handset, though I am not 100% sure.

If the Power and Home buttons are good and you can enter DFU mode there are some commercial software that may help you access the data stored within it. If not, then you need to find a professional who can specifically work on iPhones.

[Rick Cole]

My guess is that the only way to recover the data would be to rework the NAND chip into another iPhone.

Not even sure this is a viable option. Mostly the iPhones are encrypted, I would assume the key is unique and based on some hardware linked to the original handset, though I am not 100% sure.

If the Power and Home buttons are good and you can enter DFU mode there are some commercial software that may help you access the data stored within it. If not, then you need to find a professional who can specifically work on iPhones.

I am aware of the claims by commercial software to extract data from iPhones, but do any of them stand up?

Thanks

[quasimodo]

not very well in most cases


We have had good success in repairing I-phones, but not with any commercial tools. Also hddguy is right, moving the NAND will not work. At least I have not seen or heard of anyone having any success with that approach.

[pcrecovery]

I have had success with iPhones in much worse condition. PM sent.

[einstein9]

My guess is that the only way to recover the data would be to rework the NAND chip into another iPhone.

Not even sure this is a viable option. Mostly the iPhones are encrypted, I would assume the key is unique and based on some hardware linked to the original handset, though I am not 100% sure.

If the Power and Home buttons are good and you can enter DFU mode there are some commercial software that may help you access the data stored within it. If not, then you need to find a professional who can specifically work on iPhones.

correct, and i agree with you here

Iphone 4s & 5 are Encrypted, no DIY or cheap tool to handle it yet

[craig6928]

the only way your getting the data from the iphone is repairing the screen and using the correct passcode

they use a very high encryption

if you mess with it and try and enter it to many times

good bye data automatic wipes

also replacing the NAND chip into another iPhone will not work

as it works of a id code system which you can not copy
this ties information on the iphone to everything a person does on there phone and emails
example below

2b6f0cc904d137be2e1730235f5664094b831186.

welcome to big brother knowing everyhing you do on your iphone

[labtech]

Maybe not the best instructional video, but it will clue one in more:
http://www.youtube.com/watch?v=5Es3wRSe3kY

[HaQue]

the only way your getting the data from the iphone is repairing the screen and using the correct passcode

they use a very high encryption

if you mess with it and try and enter it to many times

good bye data automatic wipes

also replacing the NAND chip into another iPhone will not work

as it works of a id code system which you can not copy
this ties information on the iphone to everything a person does on there phone and emails
example below

2b6f0cc904d137be2e1730235f5664094b831186.

welcome to big brother knowing everyhing you do on your iphone

Well this "id code" example.. is this not just the GUID of the phone/user? Windows has this type of thing in the NTFS filesystem, we used to change it when the network went wonky thinking it was a name collision or something using the tool from Mark Russinovich(sysinternals) newsid.exe.. till it was kind of debunked as being any cause of any shenanigans.

I am not sure how big brother comes into it.

anyway this is an old thread, but for some reason it came up today in the unread posts?

I was searching for a specific NAND thing and found this at the same time so thought it may be useful for someone.

Code:

iOS Data Recovery Using Low-Level NAND Images
Sept.-Oct. 2013 (vol. 11 no. 5)

http://www.computer.org/csdl/mags/sp/2013/05/msp2013050049-abs.html

Code:

ABSTRACT:
To recover erased data from iOS devices, specialists use a brute-force method to decrypt the passwords, then extract data images directly from low-level NAND storage and analyze the redundancy caused by its file translation layer (FTL) behavior. iOS devices' garbage collection strategy significantly affects data recovery.

another good resource:
iOS Forensic Investigative Methods
http://www.zdziarski.com/blog/wp-content/uploads/2013/05/iOS-Forensic-Investigative-Methods.pdf

[Haltec]

Just send it to me & you'll get your data.


Haltec