Hello People!
Welcome to my near-complete dummies guide to recovering lost/deleted application data from your iPhone that have not been backed up – first generation, second generation, but not iPhone 3GS.
I am looking for someone who can complete the final step.
Please, if anyone fancies a challenge, follow my instructions and meet me at the final wall I’m up against.
Feel free to submit corrections or suggest improvements.
I own an iPhone 3G and I am running OSX Leopard on my iMac.
You will need an up-to-date version of iTunes.
The Problem
Many with iPhones have been there. It’s incredibly frustrating and answers seem few and far between. It’s so easy to unintentionally delete a file and yet to recover it appears impossible.
However which way one loses their application data, my thought was that there must be some way to recover this information.
I began this crusade when I lost all of my photos, and important voice memos from Quick Voice. This happened recently when iTunes automatically updated my iPhone's firmware to OS 3.0.
I hadn't synced my phone in some time and so this data hadn't been backed up.
I then went on to do an exhaustive search on forums and any other websites that seemed sympathetic to my cause. It quickly dawned on me that it wasn’t going to be easy since there weren’t really any clear comprehensive guides to resolving this sort of problem; just bits and pieces.
Thankfully, I brought together enough information to get as far as the last hurdle.
This is my guide so far:
First of all, why does the lost/deleted data still exist even though it appears to have gone?
In practically every hard drive there is ‘deleted’ data that can be recovered. When a file is deleted, it is not immediately removed from the hard drive. There is a section of the hard drive that is similar to a ‘Table of Contents’ and when a file is deleted it is removed from this ‘Table of Contents’. The original deleted file is left as dead space on the hard drive. Since the file still exists on the hard drive, special tools that bypass the ‘Table of Contents’ can be used to search for files and potentially recover them. These are data recovery tools.
However, the computer no longer has instructions that forbid it to overwrite this data, and so the more it is used the more likely new files will overwrite older files.
A computer writes files every time a program is used. This includes standard Internet accesses and even an operating system will overwrite certain files every time a computer is powered on. These files are not very large but they account for a significant percentage of the destruction that occurs to recoverable files. This is an excellent reason to stop using a computer as soon as it is learnt that data has been lost.
Files are generally written consecutively until it reaches the end point of the hard drive, at which point it will begin filling in the dead space from the beginning, and so on and so forth.
A file can be divided into several pieces and exist in various locations on a hard drive. Because of this, it is possible that only part of a file will be recovered. The longer it is since the files were deleted, the less probability that something can be recovered. In some instances, data has been recovered dating back several years.
Recovering data on a standard Hard Drive
To recover lost/deleted data from a standard hard drive we use ‘data recovery’ tools. One such tool is ‘Data Rescue II’ – a fantastic piece of software that I thoroughly recommend.
I have had to recover lost data before and so it a process I am familiar with. When recovering data from a standard hard drive, the process is relatively straightforward. You select the drive to scan and the software does the rest. From there, you search through the recovered files until you find the one you are after.
The problem with recovering data from an iPhone
Although we can access the iPhone and iPod Touch via iTunes, it does not mount on the desktop as a hard drive. Hence, it does not appear as a drive that we can scan with data recovery software. Apple have decided not to allow this since it takes away a lot of their power as a sole provider. This will become apparent as you read on.
From what I’ve gathered, in order to recover lost data from the iPhone, we need to mount the iPhone as a hard drive.
Now, there is a piece of software called ‘Phone View’. Although great - allowing you to access existing application data through a Finder menu and transfer otherwise non-transferable data to and from the iPhone – it doesn’t mount the phone as a drive.
The (nearest-dammit) solution to mounting the iPhone
I wasn’t able to find much about mounting the phone via USB but I was able to find information about mounting it wirelessly.
Most forums give a lot of baffling information that, to the layman, is, well… baffling! I will attempt to cut the ‘geek-speak’ and boil it down to plain, necessary English.
1) Jailbreak the iPhone
First of all we need to ‘Jailbreak’ our iPhone. In brief, this means it will allow you to install 3rd party applications. This applies to all versions of firmwares (OS 1.0, 2.0, 3.0 etc).
This is not the same as ‘unlocking’, which refers to the process of opening up your iPhone to accept SIM cards from all carriers.
There are two partitions on the iPhone:
The first partition is 300 MB in size and is the system or root partition (not to be confused with the root folder which will be seen in the second partition). This partition contains the Operating System and the default applications that are delivered with a factory fresh iPhone. This partition is designed (unless ‘Jailbroken’) to be in this pristine state for the life of the phone.
The remaining space of the hard drive is partitioned as the user-space (or media) partition. This space is where all music, videos, contacts, SMS etc are stored.
Note: The Jailbreak and subsequent firmware customisation are reversible simply by restoring the iPhone in iTunes!
We need to first download the official bit torrent to obtain the jailbreak software. The software I used is called ‘PwnageTool 3.0’ created by the ‘Dev-Team’. The bit torrent can be found on the ‘Dev-Team Blog’:
http://blog.iphone-dev.org/post/126465561/trois-drei-h-rom
Or we can download it directly from:
http://torrents.thepiratebay.org/4963802/PwnageTool_3.0.dmg.4963802.TPB.torrent
We need a file-sharing client in order to download the software from the bit torrent, such as ‘BitTorrent’, ‘Limewire’, ‘Gnutella’, or equivalent, which will automatically load when you double-click on the bit torrent download.
The software will be downloaded as a ‘Disk image’ called ‘PwnageTool_3.0.dmg’.
A ‘Disk Image’ is a single file or storage device containing the complete contents and structure representing a data storage medium or device, such as a hard drive, floppy disk, CD, or DVD. A disk image is usually created by creating a complete sector-by-sector copy of the source medium and thereby perfectly replicating the structure and contents of a storage device.
Double-click on this image to mount the disk as a drive on your desktop. Also, there will now be an icon that looks like a white piece of lego with a title beginning ‘iPhone1,2_3.0…” – this is an update file that will customise the OS 3.0 firmware. We will get to that part later.
Double-click on the newly mounted ‘PwnageTool’ drive.
Then, double-click on the pineapple icon now visible in the Finder window.
Follow these instructions, superbly explained by a kid in this MetaCafe link:
http://www.metacafe.com/watch/yt-fXedsWr6_PE/how_to_jailbreak_3_0_firmware_using_pwnage_tool_for_iphone_3g_iphone_ipod_touch/
Or follow this excellently written guide:
http://www.modmyi.com/forums/iphone-news/635661-how-jailbreak-iphone-firmware-3-0-pwnagetool.html
2) SSH’ing – Connecting iPhone to a computer wirelessly
Great! What we need to do now is something called ssh’ing!
In brief, SSH (or Secure Shell) is a ‘network protocol’ that allows data to be exchanged using a ‘secure channel’ between two networked devices.
A ‘network protocol’ is a set of rules used by computers to communicate across a network allowing data transfer.
A ‘secure channel’ is a way of transferring data that is resistant to interception and tampering.
The two networked devices in this instance are the computer and the iPhone.
The network in this instance is the Internet. So, we will be using an ‘Internet Protocol’ or IP.
In order to do this, we need to download something on our iPhone called ‘OpenSSH’.
Right, so… now that our phone has been ‘Jailbroken’, you will notice two new applications titled ‘Cydia’ and ‘Icy’.
‘Cydia’ and ‘Icy’ are basically iTunes Store equivalents for unofficial third party applications.
There are many arguments to which one is better, which I’m not going to get into, but for the purpose of this guide, I’m going to use ‘Cydia’.
Touch the ‘Cydia’ application.
Once inside the ‘Cydia’ home menu, if you scroll down, you will notice an ‘OpenSSH Access How-To’ guide. Ignore it – mine is more comprehensive!
Touch ‘Featured Packages’ on the home menu.
Scroll down and touch ‘OpenSSH’. Now select ‘install’. Please be aware that this package does not have an icon, nor should it.
Now, in order to use this package, we need to either SSH into the iPhone from a computer or SSH into your computer from your iPhone. Either way, the same data will be transferred from the iPhone to the computer. We do this by using a program that is already installed on our Macs called ‘Terminal’.
3) Using ‘Terminal’
Already installed on our Macs is a program called ‘Terminal’.
‘Terminal’ is an interface that allows the communication between two devices via SSH. It is located in the Mac HD/Applications/Utilities folder.
We can also download it onto our iPhones through ‘Cydia’. In ‘Featured Packages’, there is a package called ‘MobileTerminal’. Install this if you wish to SSH into your computer from your iPhone.
You have a choice to which ‘Terminal’ you use.
We need to make sure that both the computer and iPhone are connected to the same internet network.
Touch the ‘Settings’ icon on the iPhone and then touch ‘Wi-Fi’ and choose the correct network. While still on this screen, touch the arrow on the selected network and jot down the IP address of the iPhone. It will look like ‘192.168.0.100’, for example.
We also need the IP address of our computer. To find this, click on the Apple icon in the menu bar at the top of the screen. Select ‘System Preferences’ from the drop down menu. Select the ‘Network’ icon. You should see it under ‘Status’. Make sure that you have ‘Airport’ switched on and are connected to the internet, otherwise you won’t see the IP address.
Now we can begin to communicate between our devices!
Decide which ‘Terminal’ you want to use – the one on the computer or ‘MobileTerminal’ on the iPhone’. Each way will require a slightly different approach. Either way will do.
SSH via computer:
First of all, touch the ‘Settings’ icon on your iPhone.
Touch ‘General’.
Touch ‘Auto-Lock’.
Touch‘ Never’ - this ensures that your iPhone’s screen remains lit. If it doesn’t stay lit, we will lose connection.
Now, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.
Open ‘Terminal’ on your Mac.
The first line should say ‘Macintosh:~ Username$’
The ‘Username’ will be your username.
Here, we need to access the iPhone’s root folder.
We do this by typing: ssh root@youriphone’sIPaddress
Press return.
It will now ask for a password.
The password is ‘alpine’.
Press return.
You should now see ‘Yourname-iPhone:~ root#’
Here, we access the iPhone’s root folder and instruct it to ‘dump’ it’s disk image onto your computer. The abbreviation for this is ‘dd’ or DiskDump. This will carve out an image of the iPhone’s Hard Drive in all of it’s dimensions and deposit it on your computer. To all intents and purposes, this is your iPhone’s Hard Drive.
We do this by typing:
dd if=/dev/disk0 | ssh username@Computer’sIPaddress ‘dd of=iphone-dump.img’
You don’t need to name it ‘iphone-dump’. You can call it something else if you wish.
Note: Be sure that you don't mix up the "if" (input-file) and "of" (output-file) in the command above. Doing so could wipe your iPhone.
Press return.
Enter your computer user password.
You will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.
The transfer could take several hours. Try and be close to your Internet router box.
Progress stops at 15.12GB. This is my complete iPhone disk image.
SSH via iPhone:
Using this method, we needn’t worry about keeping the iPhone’s screen lit. For some reason, it doesn’t make any difference. I could offer a theory as to why, but at this juncture it doesn’t really matter.
As before, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.
Touch the ‘MobileTerminal’ application on the iPhone. Once open you will see:
Yourname – iPhone:~ mobile$
We need to now access the iPhone’s root folder. We do this by first typing ‘su’ (without the inverted commas).
Then we type ‘alpine’ as the requested password.
You should now see:
Yourname-iphone:/var/mobile root#
Here, type:
dd if=/dev/disk0 | ssh username@Computer’sIPaddress ‘dd of=iphone-dump.img’
as we did in the previous example and enter your computer username as the password.
As before, you will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.
The transfer could take several hours. Try and be close to your Internet router box.
Progress stops at 15.12GB. This is my complete iPhone disk image
The ‘Dead End’
In order to access the disk image, we need to first mount it as a hard drive that we can access as we would any other hard drive. To my knowledge, this is the only way we can salvage the lost/deleted data using data recovery software.
When I double-click on the ‘iphone-dump.img’ icon, a window tells me ‘no mountable file systems’. Okay, so no luck there. I tried several times but, alas, nothing more happened.
I then high-lighted the image, went to ‘File’’ in the menu at the top of the screen and then to ‘Open With’. Here I selected ‘DiskImageMounter’ but, again, I got a window telling me ‘no mountable file systems’.
I then went to open ‘Disk Utility’, which you will find in ‘System Preferences’. The problem here is that because it is only an image file (.img), it doesn’t appear as a drive to select. So, what I did was to again high-light the image, go to ‘File’ in the menu at the top of the screen and then to ‘Open With’. I selected ‘Disk Utility’. It will now appears as an icon to select. It is still, however, an ‘.img’ file. I then selected ‘Restore’ in the ‘Disk Utility’ window. This menu should restore a disk image to a disk, which is what we want. I dragged ‘iphone-dump.img’ into the ‘Source’ line and dragged whichever drive I wanted it to end up into on the ‘Destination’ line. Then I clicked the ‘Restore’ button. Unfortunately, I get ‘Restore Failure – Could not validate source. Corrupt image”.
‘Verifying’ or ‘Repairing’ the disk image also fails.
I’ve also tried mounting it using ‘Terminal’ with the commands:
hdiutil mount filename.dmg
and
hdiutil mount filename.dmg
and still nothing… just
hdiutil: mount failed - No such file or directory
I’ve also tried ‘converting’ it using the Disk Utility to a .dmg file, but this doesn’t get me any further.
I’ve tried every which way to mount the image, including using third party mounting software such as ‘Mount.app’, ‘Stuffit’ etc, and it still won’t mount!
I have transferred the disk image several times in order to rule out the possibility of a one-off transfer error.
I have found other people on a couple of forums having exactly the same problem: for example:
http://www.hackint0sh.org/forum/f127/24365.htm
Help Anyone???
Is anyone out there able to help me? Any super-techies in shining armour?
Am I overlooking something or is it simply that the disk image is corrupted?
Is there a way of comparing the disk image with the hard drive on my iPhone so I can see if anything has altered in the transfer? I’m finding it very difficult to find anything that explains how I would do it.
I’ve worked out how to ‘Checksum’ the ‘iphone-dump.img’. I did this by high-lighting the disk image, going to ‘Finder’ in the menu bar, going to ‘Services’ in the drop down menu, going to ‘Disk Utility’, and then selecting one of the two ‘Calculate Checksum’ options. I was able to view the calculated ‘Checksum’ (and it being calculated) by opening ‘Disk Utility’ and clicking on the ‘Log’ icon in the top right hand corner. I’m not yet sure which ‘Calculate Checksum’ option is relevant or what to do with the calculated ‘Checksum’ once I’ve got it.
Am I able to obtain some sort of code from the iPhone that represents it’s hard drive, therefore allowing me to compare it to a code that represents the ‘iphone-dump.img’? I think we call this a ‘Hash Value’.
If the image is corrupt, am I able to repair it manually somehow by altering the corrupt code to the correct code obtained from the iPhone?
I just don’t know!!!!! Is it more simple than I’m making out to be?
Does anyone have any ideas???
Welcome to my near-complete dummies guide to recovering lost/deleted application data from your iPhone that have not been backed up – first generation, second generation, but not iPhone 3GS.
I am looking for someone who can complete the final step.
Please, if anyone fancies a challenge, follow my instructions and meet me at the final wall I’m up against.
Feel free to submit corrections or suggest improvements.
I own an iPhone 3G and I am running OSX Leopard on my iMac.
You will need an up-to-date version of iTunes.
The Problem
Many with iPhones have been there. It’s incredibly frustrating and answers seem few and far between. It’s so easy to unintentionally delete a file and yet to recover it appears impossible.
However which way one loses their application data, my thought was that there must be some way to recover this information.
I began this crusade when I lost all of my photos, and important voice memos from Quick Voice. This happened recently when iTunes automatically updated my iPhone's firmware to OS 3.0.
I hadn't synced my phone in some time and so this data hadn't been backed up.
I then went on to do an exhaustive search on forums and any other websites that seemed sympathetic to my cause. It quickly dawned on me that it wasn’t going to be easy since there weren’t really any clear comprehensive guides to resolving this sort of problem; just bits and pieces.
Thankfully, I brought together enough information to get as far as the last hurdle.
This is my guide so far:
First of all, why does the lost/deleted data still exist even though it appears to have gone?
In practically every hard drive there is ‘deleted’ data that can be recovered. When a file is deleted, it is not immediately removed from the hard drive. There is a section of the hard drive that is similar to a ‘Table of Contents’ and when a file is deleted it is removed from this ‘Table of Contents’. The original deleted file is left as dead space on the hard drive. Since the file still exists on the hard drive, special tools that bypass the ‘Table of Contents’ can be used to search for files and potentially recover them. These are data recovery tools.
However, the computer no longer has instructions that forbid it to overwrite this data, and so the more it is used the more likely new files will overwrite older files.
A computer writes files every time a program is used. This includes standard Internet accesses and even an operating system will overwrite certain files every time a computer is powered on. These files are not very large but they account for a significant percentage of the destruction that occurs to recoverable files. This is an excellent reason to stop using a computer as soon as it is learnt that data has been lost.
Files are generally written consecutively until it reaches the end point of the hard drive, at which point it will begin filling in the dead space from the beginning, and so on and so forth.
A file can be divided into several pieces and exist in various locations on a hard drive. Because of this, it is possible that only part of a file will be recovered. The longer it is since the files were deleted, the less probability that something can be recovered. In some instances, data has been recovered dating back several years.
Recovering data on a standard Hard Drive
To recover lost/deleted data from a standard hard drive we use ‘data recovery’ tools. One such tool is ‘Data Rescue II’ – a fantastic piece of software that I thoroughly recommend.
I have had to recover lost data before and so it a process I am familiar with. When recovering data from a standard hard drive, the process is relatively straightforward. You select the drive to scan and the software does the rest. From there, you search through the recovered files until you find the one you are after.
The problem with recovering data from an iPhone
Although we can access the iPhone and iPod Touch via iTunes, it does not mount on the desktop as a hard drive. Hence, it does not appear as a drive that we can scan with data recovery software. Apple have decided not to allow this since it takes away a lot of their power as a sole provider. This will become apparent as you read on.
From what I’ve gathered, in order to recover lost data from the iPhone, we need to mount the iPhone as a hard drive.
Now, there is a piece of software called ‘Phone View’. Although great - allowing you to access existing application data through a Finder menu and transfer otherwise non-transferable data to and from the iPhone – it doesn’t mount the phone as a drive.
The (nearest-dammit) solution to mounting the iPhone
I wasn’t able to find much about mounting the phone via USB but I was able to find information about mounting it wirelessly.
Most forums give a lot of baffling information that, to the layman, is, well… baffling! I will attempt to cut the ‘geek-speak’ and boil it down to plain, necessary English.
1) Jailbreak the iPhone
First of all we need to ‘Jailbreak’ our iPhone. In brief, this means it will allow you to install 3rd party applications. This applies to all versions of firmwares (OS 1.0, 2.0, 3.0 etc).
This is not the same as ‘unlocking’, which refers to the process of opening up your iPhone to accept SIM cards from all carriers.
There are two partitions on the iPhone:
The first partition is 300 MB in size and is the system or root partition (not to be confused with the root folder which will be seen in the second partition). This partition contains the Operating System and the default applications that are delivered with a factory fresh iPhone. This partition is designed (unless ‘Jailbroken’) to be in this pristine state for the life of the phone.
The remaining space of the hard drive is partitioned as the user-space (or media) partition. This space is where all music, videos, contacts, SMS etc are stored.
Note: The Jailbreak and subsequent firmware customisation are reversible simply by restoring the iPhone in iTunes!
We need to first download the official bit torrent to obtain the jailbreak software. The software I used is called ‘PwnageTool 3.0’ created by the ‘Dev-Team’. The bit torrent can be found on the ‘Dev-Team Blog’:
http://blog.iphone-dev.org/post/126465561/trois-drei-h-rom
Or we can download it directly from:
http://torrents.thepiratebay.org/4963802/PwnageTool_3.0.dmg.4963802.TPB.torrent
We need a file-sharing client in order to download the software from the bit torrent, such as ‘BitTorrent’, ‘Limewire’, ‘Gnutella’, or equivalent, which will automatically load when you double-click on the bit torrent download.
The software will be downloaded as a ‘Disk image’ called ‘PwnageTool_3.0.dmg’.
A ‘Disk Image’ is a single file or storage device containing the complete contents and structure representing a data storage medium or device, such as a hard drive, floppy disk, CD, or DVD. A disk image is usually created by creating a complete sector-by-sector copy of the source medium and thereby perfectly replicating the structure and contents of a storage device.
Double-click on this image to mount the disk as a drive on your desktop. Also, there will now be an icon that looks like a white piece of lego with a title beginning ‘iPhone1,2_3.0…” – this is an update file that will customise the OS 3.0 firmware. We will get to that part later.
Double-click on the newly mounted ‘PwnageTool’ drive.
Then, double-click on the pineapple icon now visible in the Finder window.
Follow these instructions, superbly explained by a kid in this MetaCafe link:
http://www.metacafe.com/watch/yt-fXedsWr6_PE/how_to_jailbreak_3_0_firmware_using_pwnage_tool_for_iphone_3g_iphone_ipod_touch/
Or follow this excellently written guide:
http://www.modmyi.com/forums/iphone-news/635661-how-jailbreak-iphone-firmware-3-0-pwnagetool.html
2) SSH’ing – Connecting iPhone to a computer wirelessly
Great! What we need to do now is something called ssh’ing!
In brief, SSH (or Secure Shell) is a ‘network protocol’ that allows data to be exchanged using a ‘secure channel’ between two networked devices.
A ‘network protocol’ is a set of rules used by computers to communicate across a network allowing data transfer.
A ‘secure channel’ is a way of transferring data that is resistant to interception and tampering.
The two networked devices in this instance are the computer and the iPhone.
The network in this instance is the Internet. So, we will be using an ‘Internet Protocol’ or IP.
In order to do this, we need to download something on our iPhone called ‘OpenSSH’.
Right, so… now that our phone has been ‘Jailbroken’, you will notice two new applications titled ‘Cydia’ and ‘Icy’.
‘Cydia’ and ‘Icy’ are basically iTunes Store equivalents for unofficial third party applications.
There are many arguments to which one is better, which I’m not going to get into, but for the purpose of this guide, I’m going to use ‘Cydia’.
Touch the ‘Cydia’ application.
Once inside the ‘Cydia’ home menu, if you scroll down, you will notice an ‘OpenSSH Access How-To’ guide. Ignore it – mine is more comprehensive!
Touch ‘Featured Packages’ on the home menu.
Scroll down and touch ‘OpenSSH’. Now select ‘install’. Please be aware that this package does not have an icon, nor should it.
Now, in order to use this package, we need to either SSH into the iPhone from a computer or SSH into your computer from your iPhone. Either way, the same data will be transferred from the iPhone to the computer. We do this by using a program that is already installed on our Macs called ‘Terminal’.
3) Using ‘Terminal’
Already installed on our Macs is a program called ‘Terminal’.
‘Terminal’ is an interface that allows the communication between two devices via SSH. It is located in the Mac HD/Applications/Utilities folder.
We can also download it onto our iPhones through ‘Cydia’. In ‘Featured Packages’, there is a package called ‘MobileTerminal’. Install this if you wish to SSH into your computer from your iPhone.
You have a choice to which ‘Terminal’ you use.
We need to make sure that both the computer and iPhone are connected to the same internet network.
Touch the ‘Settings’ icon on the iPhone and then touch ‘Wi-Fi’ and choose the correct network. While still on this screen, touch the arrow on the selected network and jot down the IP address of the iPhone. It will look like ‘192.168.0.100’, for example.
We also need the IP address of our computer. To find this, click on the Apple icon in the menu bar at the top of the screen. Select ‘System Preferences’ from the drop down menu. Select the ‘Network’ icon. You should see it under ‘Status’. Make sure that you have ‘Airport’ switched on and are connected to the internet, otherwise you won’t see the IP address.
Now we can begin to communicate between our devices!
Decide which ‘Terminal’ you want to use – the one on the computer or ‘MobileTerminal’ on the iPhone’. Each way will require a slightly different approach. Either way will do.
SSH via computer:
First of all, touch the ‘Settings’ icon on your iPhone.
Touch ‘General’.
Touch ‘Auto-Lock’.
Touch‘ Never’ - this ensures that your iPhone’s screen remains lit. If it doesn’t stay lit, we will lose connection.
Now, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.
Open ‘Terminal’ on your Mac.
The first line should say ‘Macintosh:~ Username$’
The ‘Username’ will be your username.
Here, we need to access the iPhone’s root folder.
We do this by typing: ssh root@youriphone’sIPaddress
Press return.
It will now ask for a password.
The password is ‘alpine’.
Press return.
You should now see ‘Yourname-iPhone:~ root#’
Here, we access the iPhone’s root folder and instruct it to ‘dump’ it’s disk image onto your computer. The abbreviation for this is ‘dd’ or DiskDump. This will carve out an image of the iPhone’s Hard Drive in all of it’s dimensions and deposit it on your computer. To all intents and purposes, this is your iPhone’s Hard Drive.
We do this by typing:
dd if=/dev/disk0 | ssh username@Computer’sIPaddress ‘dd of=iphone-dump.img’
You don’t need to name it ‘iphone-dump’. You can call it something else if you wish.
Note: Be sure that you don't mix up the "if" (input-file) and "of" (output-file) in the command above. Doing so could wipe your iPhone.
Press return.
Enter your computer user password.
You will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.
The transfer could take several hours. Try and be close to your Internet router box.
Progress stops at 15.12GB. This is my complete iPhone disk image.
SSH via iPhone:
Using this method, we needn’t worry about keeping the iPhone’s screen lit. For some reason, it doesn’t make any difference. I could offer a theory as to why, but at this juncture it doesn’t really matter.
As before, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.
Touch the ‘MobileTerminal’ application on the iPhone. Once open you will see:
Yourname – iPhone:~ mobile$
We need to now access the iPhone’s root folder. We do this by first typing ‘su’ (without the inverted commas).
Then we type ‘alpine’ as the requested password.
You should now see:
Yourname-iphone:/var/mobile root#
Here, type:
dd if=/dev/disk0 | ssh username@Computer’sIPaddress ‘dd of=iphone-dump.img’
as we did in the previous example and enter your computer username as the password.
As before, you will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.
The transfer could take several hours. Try and be close to your Internet router box.
Progress stops at 15.12GB. This is my complete iPhone disk image
The ‘Dead End’
In order to access the disk image, we need to first mount it as a hard drive that we can access as we would any other hard drive. To my knowledge, this is the only way we can salvage the lost/deleted data using data recovery software.
When I double-click on the ‘iphone-dump.img’ icon, a window tells me ‘no mountable file systems’. Okay, so no luck there. I tried several times but, alas, nothing more happened.
I then high-lighted the image, went to ‘File’’ in the menu at the top of the screen and then to ‘Open With’. Here I selected ‘DiskImageMounter’ but, again, I got a window telling me ‘no mountable file systems’.
I then went to open ‘Disk Utility’, which you will find in ‘System Preferences’. The problem here is that because it is only an image file (.img), it doesn’t appear as a drive to select. So, what I did was to again high-light the image, go to ‘File’ in the menu at the top of the screen and then to ‘Open With’. I selected ‘Disk Utility’. It will now appears as an icon to select. It is still, however, an ‘.img’ file. I then selected ‘Restore’ in the ‘Disk Utility’ window. This menu should restore a disk image to a disk, which is what we want. I dragged ‘iphone-dump.img’ into the ‘Source’ line and dragged whichever drive I wanted it to end up into on the ‘Destination’ line. Then I clicked the ‘Restore’ button. Unfortunately, I get ‘Restore Failure – Could not validate source. Corrupt image”.
‘Verifying’ or ‘Repairing’ the disk image also fails.
I’ve also tried mounting it using ‘Terminal’ with the commands:
hdiutil mount filename.dmg
and
hdiutil mount filename.dmg
and still nothing… just
hdiutil: mount failed - No such file or directory
I’ve also tried ‘converting’ it using the Disk Utility to a .dmg file, but this doesn’t get me any further.
I’ve tried every which way to mount the image, including using third party mounting software such as ‘Mount.app’, ‘Stuffit’ etc, and it still won’t mount!
I have transferred the disk image several times in order to rule out the possibility of a one-off transfer error.
I have found other people on a couple of forums having exactly the same problem: for example:
http://www.hackint0sh.org/forum/f127/24365.htm
Help Anyone???
Is anyone out there able to help me? Any super-techies in shining armour?
Am I overlooking something or is it simply that the disk image is corrupted?
Is there a way of comparing the disk image with the hard drive on my iPhone so I can see if anything has altered in the transfer? I’m finding it very difficult to find anything that explains how I would do it.
I’ve worked out how to ‘Checksum’ the ‘iphone-dump.img’. I did this by high-lighting the disk image, going to ‘Finder’ in the menu bar, going to ‘Services’ in the drop down menu, going to ‘Disk Utility’, and then selecting one of the two ‘Calculate Checksum’ options. I was able to view the calculated ‘Checksum’ (and it being calculated) by opening ‘Disk Utility’ and clicking on the ‘Log’ icon in the top right hand corner. I’m not yet sure which ‘Calculate Checksum’ option is relevant or what to do with the calculated ‘Checksum’ once I’ve got it.
Am I able to obtain some sort of code from the iPhone that represents it’s hard drive, therefore allowing me to compare it to a code that represents the ‘iphone-dump.img’? I think we call this a ‘Hash Value’.
If the image is corrupt, am I able to repair it manually somehow by altering the corrupt code to the correct code obtained from the iPhone?
I just don’t know!!!!! Is it more simple than I’m making out to be?
Does anyone have any ideas???
