Hi there.
Good friends of mine recently suffered the loss of their 23 year old daughter in a tragic hiking accident. As part of their grieving, they are currently going through a process of wanting to get to know and understand her as much as they can... as a parent myself who can't even begin to imagine what they're going through, I have to suspect I'd be doing much the same.
They have her iPhone and the laptop she used to sync it with iTunes in the past, but her iPhone is locked with a 4 digit code they don't know, and it would mean the world to them to retrieve their daughters photos and other information from the phone if possible. It appears it is an iPhone 4s running iOS 7.1.
I found on the laptop a backup of the iPhone made several weeks prior to her passing, and was able to copy this backup to a different computer and then restore that backup to a different iPhone (one of mine) to give them a snapshot of her life at that time. This was hugely helpful to them, but of course, the events in their daughter's last couple of weeks prior to her passing are the most important to them, and they know that a lot of this is currently on her iPhone.
They have tried guessing the passcode approximately 10 times, though I've warned them against trying indefinitely as the iPhone will eventually lock them out entirely requiring it to be restored from the backup, essentially erasing whatever memories they might be able to retrieve from those last two weeks. So I want to proceed very carefully, and hopefully as nondestructively as possible.
I've tried to backup this iPhone onto a different computer, but it requires the passcode to be entered on the iPhone, which of course I can't do. And though she's backed up the iPhone to her laptop in the past, when I attempt to do a fresh backup with her laptop (the idea to be to backup and restore without the passcode), iTunes tells me I have to unlock the phone first.
This isn't an issue of regaining use of the iPhone, which could simply be returning it to DFU mode, and then restoring from the backup we have. They frankly couldn't care less about using the iPhone hardware itself, and I doubt they will ever repurpose it. They just don't want to lose whatever is on that phone from the past couple of weeks.
Is there anything I can try to recover the data from the iPhone without knowing its passcode or putting the iPhone in a state where it will only be able to restore from the prior backup? I'm open to trying anything, but most especially "read only" solutions to the phone that don't run the risk of damaging any of the data that's on there. It truly is, in every possible sense of the word, irreplaceable.
Apple's stance on the matter seems to be to simply backup and restore, or restore from a prior backup if you can't make a current one. And I have no idea why her laptop is telling me I have to unlock her iPhone first before it will back up even though it's backed up in the past - my own iPhone doesn't do that.
I don't know if she's turned "Find my iPhone" on or not if that makes a difference.
We know her apple ID email address (a Hotmail account) but not her apple ID password, nor her Hotmail password. I was hoping that perhaps I could retrieve at least some of that information from her laptop's Keychain if it's there.. .but unfortunately, they don't know her laptop local account password either. That poses another problem. Actually, when they took possession of her laptop it was in sleep mode, but her account was already logged in. They are now fearful to log out or restart that computer that they'll be locked out entirely. I know that for the laptop at least, if worse comes to worse, I can always boot into single user mode (or even in Firewire target mode) to recover data from the laptop. But both processes require a reboot of the laptop and they're not ready to go down that road yet in fear it would close the small window they currently have with it.
They are hoping that if we figure out her laptop password that they could view passwords and other information for other web sites she frequented from her Keychain. Do I presume correctly that if we change her laptop password (easily enough done once they reach the point where they'll allow me to reboot the laptop) that the Keychain information is lost? If so, resetting the password is one of the last options they'd consider. I know /private/var/db/shadow/hash is where password hashes used to be kept in older versions of Mac OS - where are they now stored in Mavericks or Mountain Lion? (not sure which version she's running, but it's one of the last two). I'm hoping if I can get the hash I can run something like John the Ripper on it to try and recover the actual password itself if she was using something simple.
They'd be more than willing to provide the laptop and iPhone to Apple themselves (along with their daughter's death certificate to prove their "claim" to it), but haven't heard anything other than the "restore from backup" mantra. I don't know if this is more of Apple's policy on information privacy, or if there is really no technical way to get to the data behind the 4 digit passcode.
I know they're clinging to what little they have left, and don't want to let go of any small parts of her, but I'm not in a position to judge - I want to help them in any way I can. I'm hoping that if there is a way to do it, someone here might be able to point me in the direction as to how, or at least provide me with some ideas to try.
Thanks for any help you may be able to provide.
Good friends of mine recently suffered the loss of their 23 year old daughter in a tragic hiking accident. As part of their grieving, they are currently going through a process of wanting to get to know and understand her as much as they can... as a parent myself who can't even begin to imagine what they're going through, I have to suspect I'd be doing much the same.
They have her iPhone and the laptop she used to sync it with iTunes in the past, but her iPhone is locked with a 4 digit code they don't know, and it would mean the world to them to retrieve their daughters photos and other information from the phone if possible. It appears it is an iPhone 4s running iOS 7.1.
I found on the laptop a backup of the iPhone made several weeks prior to her passing, and was able to copy this backup to a different computer and then restore that backup to a different iPhone (one of mine) to give them a snapshot of her life at that time. This was hugely helpful to them, but of course, the events in their daughter's last couple of weeks prior to her passing are the most important to them, and they know that a lot of this is currently on her iPhone.
They have tried guessing the passcode approximately 10 times, though I've warned them against trying indefinitely as the iPhone will eventually lock them out entirely requiring it to be restored from the backup, essentially erasing whatever memories they might be able to retrieve from those last two weeks. So I want to proceed very carefully, and hopefully as nondestructively as possible.
I've tried to backup this iPhone onto a different computer, but it requires the passcode to be entered on the iPhone, which of course I can't do. And though she's backed up the iPhone to her laptop in the past, when I attempt to do a fresh backup with her laptop (the idea to be to backup and restore without the passcode), iTunes tells me I have to unlock the phone first.
This isn't an issue of regaining use of the iPhone, which could simply be returning it to DFU mode, and then restoring from the backup we have. They frankly couldn't care less about using the iPhone hardware itself, and I doubt they will ever repurpose it. They just don't want to lose whatever is on that phone from the past couple of weeks.
Is there anything I can try to recover the data from the iPhone without knowing its passcode or putting the iPhone in a state where it will only be able to restore from the prior backup? I'm open to trying anything, but most especially "read only" solutions to the phone that don't run the risk of damaging any of the data that's on there. It truly is, in every possible sense of the word, irreplaceable.
Apple's stance on the matter seems to be to simply backup and restore, or restore from a prior backup if you can't make a current one. And I have no idea why her laptop is telling me I have to unlock her iPhone first before it will back up even though it's backed up in the past - my own iPhone doesn't do that.
I don't know if she's turned "Find my iPhone" on or not if that makes a difference.
We know her apple ID email address (a Hotmail account) but not her apple ID password, nor her Hotmail password. I was hoping that perhaps I could retrieve at least some of that information from her laptop's Keychain if it's there.. .but unfortunately, they don't know her laptop local account password either. That poses another problem. Actually, when they took possession of her laptop it was in sleep mode, but her account was already logged in. They are now fearful to log out or restart that computer that they'll be locked out entirely. I know that for the laptop at least, if worse comes to worse, I can always boot into single user mode (or even in Firewire target mode) to recover data from the laptop. But both processes require a reboot of the laptop and they're not ready to go down that road yet in fear it would close the small window they currently have with it.
They are hoping that if we figure out her laptop password that they could view passwords and other information for other web sites she frequented from her Keychain. Do I presume correctly that if we change her laptop password (easily enough done once they reach the point where they'll allow me to reboot the laptop) that the Keychain information is lost? If so, resetting the password is one of the last options they'd consider. I know /private/var/db/shadow/hash is where password hashes used to be kept in older versions of Mac OS - where are they now stored in Mavericks or Mountain Lion? (not sure which version she's running, but it's one of the last two). I'm hoping if I can get the hash I can run something like John the Ripper on it to try and recover the actual password itself if she was using something simple.
They'd be more than willing to provide the laptop and iPhone to Apple themselves (along with their daughter's death certificate to prove their "claim" to it), but haven't heard anything other than the "restore from backup" mantra. I don't know if this is more of Apple's policy on information privacy, or if there is really no technical way to get to the data behind the 4 digit passcode.
I know they're clinging to what little they have left, and don't want to let go of any small parts of her, but I'm not in a position to judge - I want to help them in any way I can. I'm hoping that if there is a way to do it, someone here might be able to point me in the direction as to how, or at least provide me with some ideas to try.
Thanks for any help you may be able to provide.
