iPhone Help retrieving information from locked iPhone

Discussion in 'Jailbreaks and iOS Hacks' started by Apollo13, Aug 26, 2014.

  1. Apollo13 macrumors newbie

    Aug 26, 2014
    Hi there.

    Good friends of mine recently suffered the loss of their 23 year old daughter in a tragic hiking accident. As part of their grieving, they are currently going through a process of wanting to get to know and understand her as much as they can... as a parent myself who can't even begin to imagine what they're going through, I have to suspect I'd be doing much the same.

    They have her iPhone and the laptop she used to sync it with iTunes in the past, but her iPhone is locked with a 4 digit code they don't know, and it would mean the world to them to retrieve their daughters photos and other information from the phone if possible. It appears it is an iPhone 4s running iOS 7.1.

    I found on the laptop a backup of the iPhone made several weeks prior to her passing, and was able to copy this backup to a different computer and then restore that backup to a different iPhone (one of mine) to give them a snapshot of her life at that time. This was hugely helpful to them, but of course, the events in their daughter's last couple of weeks prior to her passing are the most important to them, and they know that a lot of this is currently on her iPhone.

    They have tried guessing the passcode approximately 10 times, though I've warned them against trying indefinitely as the iPhone will eventually lock them out entirely requiring it to be restored from the backup, essentially erasing whatever memories they might be able to retrieve from those last two weeks. So I want to proceed very carefully, and hopefully as nondestructively as possible.

    I've tried to backup this iPhone onto a different computer, but it requires the passcode to be entered on the iPhone, which of course I can't do. And though she's backed up the iPhone to her laptop in the past, when I attempt to do a fresh backup with her laptop (the idea to be to backup and restore without the passcode), iTunes tells me I have to unlock the phone first.

    This isn't an issue of regaining use of the iPhone, which could simply be returning it to DFU mode, and then restoring from the backup we have. They frankly couldn't care less about using the iPhone hardware itself, and I doubt they will ever repurpose it. They just don't want to lose whatever is on that phone from the past couple of weeks.

    Is there anything I can try to recover the data from the iPhone without knowing its passcode or putting the iPhone in a state where it will only be able to restore from the prior backup? I'm open to trying anything, but most especially "read only" solutions to the phone that don't run the risk of damaging any of the data that's on there. It truly is, in every possible sense of the word, irreplaceable.

    Apple's stance on the matter seems to be to simply backup and restore, or restore from a prior backup if you can't make a current one. And I have no idea why her laptop is telling me I have to unlock her iPhone first before it will back up even though it's backed up in the past - my own iPhone doesn't do that.

    I don't know if she's turned "Find my iPhone" on or not if that makes a difference.

    We know her apple ID email address (a Hotmail account) but not her apple ID password, nor her Hotmail password. I was hoping that perhaps I could retrieve at least some of that information from her laptop's Keychain if it's there.. .but unfortunately, they don't know her laptop local account password either. That poses another problem. Actually, when they took possession of her laptop it was in sleep mode, but her account was already logged in. They are now fearful to log out or restart that computer that they'll be locked out entirely. I know that for the laptop at least, if worse comes to worse, I can always boot into single user mode (or even in Firewire target mode) to recover data from the laptop. But both processes require a reboot of the laptop and they're not ready to go down that road yet in fear it would close the small window they currently have with it.

    They are hoping that if we figure out her laptop password that they could view passwords and other information for other web sites she frequented from her Keychain. Do I presume correctly that if we change her laptop password (easily enough done once they reach the point where they'll allow me to reboot the laptop) that the Keychain information is lost? If so, resetting the password is one of the last options they'd consider. I know /private/var/db/shadow/hash is where password hashes used to be kept in older versions of Mac OS - where are they now stored in Mavericks or Mountain Lion? (not sure which version she's running, but it's one of the last two). I'm hoping if I can get the hash I can run something like John the Ripper on it to try and recover the actual password itself if she was using something simple.

    They'd be more than willing to provide the laptop and iPhone to Apple themselves (along with their daughter's death certificate to prove their "claim" to it), but haven't heard anything other than the "restore from backup" mantra. I don't know if this is more of Apple's policy on information privacy, or if there is really no technical way to get to the data behind the 4 digit passcode.

    I know they're clinging to what little they have left, and don't want to let go of any small parts of her, but I'm not in a position to judge - I want to help them in any way I can. I'm hoping that if there is a way to do it, someone here might be able to point me in the direction as to how, or at least provide me with some ideas to try.

    Thanks for any help you may be able to provide.
  2. Applejuiced, Aug 27, 2014
    Last edited: Aug 27, 2014

    Applejuiced macrumors Westmere


    Apr 16, 2008
    At the iPhone hacks section.
    Way too long to read.
    So in short its locked with a passcode.
    And its also icloud locked.
    And you don't know the password to the apple ID and neither the password to the email linked to it to reset the password and you don't know the passcode to the laptop. Way too many crazy coincidences on how no one knows any of those passwords. Always newbies with 1 post come up with these wild stories.
    You are out of luck. Everything on the phone cannot be accessed and most likely if find my iphone is turned on then the phone is useless.
    Good luck.
  3. Apollo13 thread starter macrumors newbie

    Aug 26, 2014
    Sorry for the length of the response, but in my experience it's always better to provide more information in trying to solve a problem in not enough.

    I never claimed that her parents were the real owner of the device - they'll freely admit they're not. This isn't an issue of "coincidences" of not knowing any of the passwords. I do realize that a scenario like this may be used by those trying to explain their way into breaking into an iPhone, and I have no way to prove anything I'm saying. The parents have her death certificate, though I do not, nor would I ask them for permission to post it here if I did. They would have no problem giving it to Apple directly to prove their situation, but so far everyone they've spoken to at Apple have been rather unhelpful. If someone here knows someone at Apple we should be speaking with, please let me know.

    I could provide online references for news stories about the accident, but of course a person wouldn't necessarily believe the story is referring to the girl whose family I'm helping. If you have a suggestion on a way I can avoid skepticism, feel free to make it.

    In short, either a person with knowledge on how to retrieve the information decides to take this situation at face value and help or they don't. I can't control what a person believes, but I have a hard time accepting that there just "is no way", and I've told the family I'd exhaust all possibilities on retrieving their daughter's data from the phone. I suspect this forum would provide a good possibility of having the skill set to help, which is why I've posted here. Or if it really, truly, can't be done, I'd also like to know so I could stop spending my time on it. But though I can understand why you made an implication that this may be a "wild story", all I can do is ask for help. And I have a hard time trusting the opinion of someone who in most of their posting seems to concentrate themselves on being skeptical of the situation rather than genuinely looking for a technical solution.

    It's possible that we may be able to sort out her laptop and/or apple ID password (perhaps Apple will be able to relinquish control of her apple ID to her parents with the right documentation?), and if we do, perhaps more doors will open. Does anyone know of a way of retrieving the data off the iPhone if we did find her passwords for those, despite the iPhone still being locked with a 4 digit code?

    In any case, I can't make anyone believe my situation. If you choose not to, that's your choice.
  4. Applejuiced macrumors Westmere


    Apr 16, 2008
    At the iPhone hacks section.
    You can try contacting Apple and their higher up corporate customer support.
    Provide the documentation that they have to them and hope they will help you.
  5. SpyderBite macrumors 65816


    Oct 4, 2011
    This will require a court order which should be no problem as the parents certainly have proof of death.

Share This Page