OT - iPhone Data Recovery - SOLVED!

[Narflex]

UPDATE: I recovered all the data from the phone and restored it. Read this thread if you want to know how.

Anyone here got any recommendations for a company who can do data recovery on an iPhone?

The wife's iPhone locked up on her last week so I did a hard reset on it. It then went into an infinite reboot cycle (it'd be stuck on the Apple logo for like 10 minutes, then reboot, over and over again). About 24 hours later it came back to life. I *would* have done a backup at that point; but we were out of town. And of course before we got back; it locked up again....did a hard reset...and same problem. But 5 days later (and now that we're home) it still didn't come back to life.

I don't want to do a firmware restore on it because she has lots of pictures & contacts in there she wants to preserve (and shame on me for thinking my wife would regularly sync & backup her own phone). I've found a few data recovery places in LA; but there's some very shoddy reviews of them and don't want to get screwed. (i.e. dataretrieval.com and the half dozen other names the same company runs under)

So do any of our wonderful forum users have recommendations on data recovery places for iPhone?

(or if you have an idea about how I could do it myself....let me know...but if I plug it in over USB to a PC it doesn't see anything at all over the USB connection...did it with Linux and there's nothing at all there in the USB system from that device so I'm pretty sure the OS isn't even getting to a point where the USB port does anything but take a charge)

Thanks in advance for any help.

[stuckless]

I can't help with the data recovery, but I've had to reboot my ipad and ipod touch many times... And I've had my ipod touch freeze up during a reboot as well. I'm sorry if I'm stating the obvious, but have your tried holding power and home button for a very long time? (something like this article) I've done this a couple times myself.

[Narflex]

Originally Posted by stuckless

I can't help with the data recovery, but I've had to reboot my ipad and ipod touch many times... And I've had my ipod touch freeze up during a reboot as well. I'm sorry if I'm stating the obvious, but have your tried holding power and home button for a very long time? (something like this article) I've done this a couple times myself.

That's exactly what I don't want to do. I'm quite sure that if I put it into that firmware restore mode that it'll wipe out all the contacts/pictures on the device.

What would be groovy was if there was a way to do that without actually trashing the contacts/pictures. I did find some info which said to just do the restore; and then jailbreak it and install ssh so you can do a 'dd' dump of the flash memory. Then run a tool on that extracted binary which finds the JPEG images based off their headers and pulls them out (I'd actually like to try to do that for fun since I've had to do so much JPEG handling with SageTV). But I'm concerned that I'd lose data from fragmentation (although her memory was nowhere near full, so it's likely not fragmented); or from things getting overwritten as part of the restore (that's my biggest fear).

I could also be wrong in that the restore process doesn't trash the contacts/pictures.....but so far everything I've read indicated that is true.

[stuckless]

Originally Posted by Narflex

That's exactly what I don't want to do. I'm quite sure that if I put it into that firmware restore mode that it'll wipe out all the contacts/pictures on the device.

What would be groovy was if there was a way to do that without actually trashing the contacts/pictures. I did find some info which said to just do the restore; and then jailbreak it and install ssh so you can do a 'dd' dump of the flash memory. Then run a tool on that extracted binary which finds the JPEG images based off their headers and pulls them out (I'd actually like to try to do that for fun since I've had to do so much JPEG handling with SageTV). But I'm concerned that I'd lose data from fragmentation (although her memory was nowhere near full, so it's likely not fragmented); or from things getting overwritten as part of the restore (that's my biggest fear).

I could also be wrong in that the restore process doesn't trash the contacts/pictures.....but so far everything I've read indicated that is true.

yeah, I wasn't suggesting doing a firmware restore, just holding down the power + menu long enough to force the unit to do a cold reboot. If it boots a litle further in the process, then maybe you can get to a point where you can either install a jailbreak or maybe use some other tool to get access to the data.

I think that full firmware restore will wipe the phone, but if you do it through a working windows itunes setup, then apple should backup the contents before doing a firmware restore.

[Narflex]

Originally Posted by stuckless

yeah, I wasn't suggesting doing a firmware restore, just holding down the power + menu long enough to force the unit to do a cold reboot. If it boots a litle further in the process, then maybe you can get to a point where you can either install a jailbreak or maybe use some other tool to get access to the data.

Oh yeah, I've tried that many, many times. Never any change. It does show the spinning circle (although it's not animated) at one point; and then it redraws it again a little later (because it becomes brighter) and then it reboots after that. But with all the resets I've done I haven't managed to get it to do anything different.

Originally Posted by stuckless

I think that full firmware restore will wipe the phone, but if you do it through a working windows itunes setup, then apple should backup the contents before doing a firmware restore.

This is where I'm very curious. So if I put it into that mode as suggested in that article you linked to which *should* then have it show the 'Connect to iTunes' screen when it boots....would iTunes then prompt me to do a backup of the device before it does a firmware restore? I haven't read anywhere that it'll do that; so far what I've found indicates it'll then just restore the firmware and wipe the phone all at once. If you have a backup it'll restore that...but we don't have that backup.

I'm tempted to try this on my working iPhone to see how the process goes (after being 100% sure I have a full backup of course). But if someone knows the answer that'd be great to avoid having to go through that test process.

[jarredduq]

How long has it been since the firmware had been updated through iTunes? During that process iTunes would have made a backup if the phone.

Please note that you asked by putting your phone into restore mode, if iTunes would ask to back it up. It will not, but will just restore the phone to factory default.

If the last firmware update was done not that long ago, you could do the restore and recover from the most recent backup.

You can also check the date of the last backup in the folder where the backups are saved. The link below shows the location of those backup files.

http://osxdaily.com/2009/09/11/iphone-backup-location/

[Fuzzy]

I just pull the microSD card out, put it in the new phone, and restore the rest of the personal data from the google backups.. oh wait.. nevermind.. :-)

[PLUCKYHD]

Jeff,

Itunes should have a copy of your phone the last time you synched it.

Also pretty sure as well when you upgrade the firmware it backs it up first. I know mine did when I upgraded ours the other day.

All else falls call apple support they are one of the few companies that I hold up with SageTV support. (although sagetv is the top, followed by aperion, then apple)

[Narflex]

It hasn't been plugged into a pc in about a year. I checked the timestamps on the backup files to confirm that.

I'm going to bring it to the apple store today to see if they can help. I'm hoping they have some utility that can dump the filesystem in recovery mode. I would expect the interface in that mode has the ability to read the flash memory since it definitely has the ability to overwrite it.

[bcjenkins]

http://www.drivesaversdatarecovery.c...data-recovery/

[Narflex]

Thanks Brandon. I just talked to them, but pricing is in the $600-$1200 range for recovery which is more than we'd want to spend on this. Time to visit the apple store to see if they can help; and if not...time to try to exploit my own skills to solve the problem....you know I'm looking forward to that option.

[PLUCKYHD]

Originally Posted by Narflex

It hasn't been plugged into a pc in about a year. I checked the timestamps on the backup files to confirm that.

I'm going to bring it to the apple store today to see if they can help. I'm hoping they have some utility that can dump the filesystem in recovery mode. I would expect the interface in that mode has the ability to read the flash memory since it definitely has the ability to overwrite it.

woah someone doesn't run the latest ios software

[panteragstk]

I asked some buddies I work with that actually used to do iphone support for apple and they said you are SOL. Sorry, I tried.

I do think the irony of you asking for support from us very funny though.

Originally Posted by Fuzzy

I just pull the microSD card out, put it in the new phone, and restore the rest of the personal data from the google backups.. oh wait.. nevermind.. :-)

I was about to say...

[Narflex]

I also checked the SIM card now and there's nothing on it unfortunately.

There was another idea I had though....the phone was JB'd about a year ago. When that was done; I recall one of the steps being the iPhone booting in recovery mode which is then how it loaded the JB'd firmware. I *think* it was non-destructive because it didn't destroy any data on the phone. Or maybe it did but then restored it from the current backup. But hopefully it was the former. So I'm thinking if I put the phone into recovery mode (I've verified I can do that); I then load the JB'd firmware on it like before and then it might be OK. Any thoughts on that? It's not something Apple support would indicate might work of course.

[bcjenkins]

http://www.amazon.com/iPod-iPhone-Fo.../dp/1597492973

PS - I have a former colleague who is a forensics tech for a DC firm that might be of use if you get stuck.

[ToxMox]

Didn't have time to read the whole thread but maybe this will help

http://www.hackint0sh.org/f127/60910.htm

[QueOnda]

Originally Posted by Narflex

Thanks Brandon. I just talked to them, but pricing is in the $600-$1200 range for recovery which is more than we'd want to spend on this. Time to visit the apple store to see if they can help; and if not...time to try to exploit my own skills to solve the problem....you know I'm looking forward to that option.

I used these guys last year for a problem I had with a readynas xraid box. They were cheaper but great service. http://www.datarecovery.com/ipodrecovery.asp

[Narflex]

So I am able to sort of access the phone with iRecovery. But it's not responding to any commands aside from reboot. Most of the stuff I've seen shows them running 'printenv' with results; but I get nothing from that. There's a 'failure' in there which concerns me that the problem may be more serious. I also tried iBooter; and after hexediting it then it recognized a phone was there; but then just error'd out. I think iBooter only supports older phones though.

C:\iRecovery\iRecovery_SVN>iRecovery.exe -s
iRecovery - Recovery Utility
by wEsTbAeR-- and Tom3q

Got USB


=======================================
::
:: iRain for n82ap, Copyright 2009, Apple Inc.
::
::      BUILD_TAG: iBoot-636.66
::
::      BUILD_STYLE: RELEASE
::
::      USB_SERIAL_NUMBER: CPID:8900 CPRV:30 CPFM:03 SCEP:05 BDID:04 ECID:000003
189C15838E IBFL:01 SRNM:[83834VPKY7H]
::
=======================================

[FTL:MSG] Apple NAND Driver (AND) RO
[NAND] Device ID           0xba94d598
[NAND] BANKS_TOTAL         4
[NAND] BLOCKS_PER_BANK     4096
G] FTL_Open            [OK]524288
Boot Failure Count: 15  Panic Fail Count: 0
Entering recovery mode, starting command prompt
       [OK]
[FTL:MSG] FPart Init          [OK]
read old style signature 0x43303035 (line:371)
[FTL:MSG] VFL Register    [OK]
[FTL:MSG] VFL Init            [OK]
[FTL:MSG] VFL_Open            [OK]
[FTL:MSG] FTL Register    [OK]
[FTL:WRN] Failure running _LoadFTLCxt!
[FTL:WRN] Recovering NAND Data Structures - this will take some time!
[FTL:WRN] _FTLRestore OK!
[FTL:MG] FTL_Open            [OK]
Boot Failure Count: 15  Panic Fail Count: 0
Entering recovery mode, starting command prompt
(Recovery) iPhone$ printenv
(Recovery) iPhone$ /exit
Closing USB connection...

The forensic analysis stuff probably is only for working phones; so I don't think that'll help.

And that other data recovery company seems like they only handle hard disks from iPods and not iPhones.

Now that I can barely access the phone I'm hoping there's some tool I can find to dump the memory of it.

[bcjenkins]

dd FTW!

[Narflex]

Originally Posted by bcjenkins

dd FTW!

What do you mean? Irecovery doesn't have the dd command.