iPhone Recovering Lost/Deleted Data From An iPhone That Has Not Been Backed Up

Discussion in 'Jailbreaks and iOS Hacks' started by atomic hooligan, Jul 4, 2009.

  1. atomic hooligan macrumors newbie

    Jul 4, 2009
    Hello People!

    Welcome to my near-complete dummies guide to recovering lost/deleted application data from your iPhone that have not been backed up – first generation, second generation, but not iPhone 3GS.

    I am looking for someone who can complete the final step.

    Please, if anyone fancies a challenge, follow my instructions and meet me at the final wall I’m up against.

    Feel free to submit corrections or suggest improvements.

    I own an iPhone 3G and I am running OSX Leopard on my iMac.

    You will need an up-to-date version of iTunes.

    The Problem

    Many with iPhones have been there. It’s incredibly frustrating and answers seem few and far between. It’s so easy to unintentionally delete a file and yet to recover it appears impossible.

    However which way one loses their application data, my thought was that there must be some way to recover this information.

    I began this crusade when I lost all of my photos, and important voice memos from Quick Voice. This happened recently when iTunes automatically updated my iPhone's firmware to OS 3.0.

    I hadn't synced my phone in some time and so this data hadn't been backed up.

    I then went on to do an exhaustive search on forums and any other websites that seemed sympathetic to my cause. It quickly dawned on me that it wasn’t going to be easy since there weren’t really any clear comprehensive guides to resolving this sort of problem; just bits and pieces.

    Thankfully, I brought together enough information to get as far as the last hurdle.

    This is my guide so far:

    First of all, why does the lost/deleted data still exist even though it appears to have gone?

    In practically every hard drive there is ‘deleted’ data that can be recovered. When a file is deleted, it is not immediately removed from the hard drive. There is a section of the hard drive that is similar to a ‘Table of Contents’ and when a file is deleted it is removed from this ‘Table of Contents’. The original deleted file is left as dead space on the hard drive. Since the file still exists on the hard drive, special tools that bypass the ‘Table of Contents’ can be used to search for files and potentially recover them. These are data recovery tools.

    However, the computer no longer has instructions that forbid it to overwrite this data, and so the more it is used the more likely new files will overwrite older files.

    A computer writes files every time a program is used. This includes standard Internet accesses and even an operating system will overwrite certain files every time a computer is powered on. These files are not very large but they account for a significant percentage of the destruction that occurs to recoverable files. This is an excellent reason to stop using a computer as soon as it is learnt that data has been lost.

    Files are generally written consecutively until it reaches the end point of the hard drive, at which point it will begin filling in the dead space from the beginning, and so on and so forth.

    A file can be divided into several pieces and exist in various locations on a hard drive. Because of this, it is possible that only part of a file will be recovered. The longer it is since the files were deleted, the less probability that something can be recovered. In some instances, data has been recovered dating back several years.

    Recovering data on a standard Hard Drive

    To recover lost/deleted data from a standard hard drive we use ‘data recovery’ tools. One such tool is ‘Data Rescue II’ – a fantastic piece of software that I thoroughly recommend.

    I have had to recover lost data before and so it a process I am familiar with. When recovering data from a standard hard drive, the process is relatively straightforward. You select the drive to scan and the software does the rest. From there, you search through the recovered files until you find the one you are after.

    The problem with recovering data from an iPhone

    Although we can access the iPhone and iPod Touch via iTunes, it does not mount on the desktop as a hard drive. Hence, it does not appear as a drive that we can scan with data recovery software. Apple have decided not to allow this since it takes away a lot of their power as a sole provider. This will become apparent as you read on.

    From what I’ve gathered, in order to recover lost data from the iPhone, we need to mount the iPhone as a hard drive.

    Now, there is a piece of software called ‘Phone View’. Although great - allowing you to access existing application data through a Finder menu and transfer otherwise non-transferable data to and from the iPhone – it doesn’t mount the phone as a drive.

    The (nearest-dammit) solution to mounting the iPhone

    I wasn’t able to find much about mounting the phone via USB but I was able to find information about mounting it wirelessly.

    Most forums give a lot of baffling information that, to the layman, is, well… baffling! I will attempt to cut the ‘geek-speak’ and boil it down to plain, necessary English.

    1) Jailbreak the iPhone

    First of all we need to ‘Jailbreak’ our iPhone. In brief, this means it will allow you to install 3rd party applications. This applies to all versions of firmwares (OS 1.0, 2.0, 3.0 etc).

    This is not the same as ‘unlocking’, which refers to the process of opening up your iPhone to accept SIM cards from all carriers.

    There are two partitions on the iPhone:

    The first partition is 300 MB in size and is the system or root partition (not to be confused with the root folder which will be seen in the second partition). This partition contains the Operating System and the default applications that are delivered with a factory fresh iPhone. This partition is designed (unless ‘Jailbroken’) to be in this pristine state for the life of the phone.

    The remaining space of the hard drive is partitioned as the user-space (or media) partition. This space is where all music, videos, contacts, SMS etc are stored.

    Note: The Jailbreak and subsequent firmware customisation are reversible simply by restoring the iPhone in iTunes!

    We need to first download the official bit torrent to obtain the jailbreak software. The software I used is called ‘PwnageTool 3.0’ created by the ‘Dev-Team’. The bit torrent can be found on the ‘Dev-Team Blog’:


    Or we can download it directly from:


    We need a file-sharing client in order to download the software from the bit torrent, such as ‘BitTorrent’, ‘Limewire’, ‘Gnutella’, or equivalent, which will automatically load when you double-click on the bit torrent download.

    The software will be downloaded as a ‘Disk image’ called ‘PwnageTool_3.0.dmg’.

    A ‘Disk Image’ is a single file or storage device containing the complete contents and structure representing a data storage medium or device, such as a hard drive, floppy disk, CD, or DVD. A disk image is usually created by creating a complete sector-by-sector copy of the source medium and thereby perfectly replicating the structure and contents of a storage device.

    Double-click on this image to mount the disk as a drive on your desktop. Also, there will now be an icon that looks like a white piece of lego with a title beginning ‘iPhone1,2_3.0…” – this is an update file that will customise the OS 3.0 firmware. We will get to that part later.

    Double-click on the newly mounted ‘PwnageTool’ drive.

    Then, double-click on the pineapple icon now visible in the Finder window.

    Follow these instructions, superbly explained by a kid in this MetaCafe link:


    Or follow this excellently written guide:


    2) SSH’ing – Connecting iPhone to a computer wirelessly

    Great! What we need to do now is something called ssh’ing!

    In brief, SSH (or Secure Shell) is a ‘network protocol’ that allows data to be exchanged using a ‘secure channel’ between two networked devices.

    A ‘network protocol’ is a set of rules used by computers to communicate across a network allowing data transfer.

    A ‘secure channel’ is a way of transferring data that is resistant to interception and tampering.

    The two networked devices in this instance are the computer and the iPhone.

    The network in this instance is the Internet. So, we will be using an ‘Internet Protocol’ or IP.

    In order to do this, we need to download something on our iPhone called ‘OpenSSH’.

    Right, so… now that our phone has been ‘Jailbroken’, you will notice two new applications titled ‘Cydia’ and ‘Icy’.

    ‘Cydia’ and ‘Icy’ are basically iTunes Store equivalents for unofficial third party applications.

    There are many arguments to which one is better, which I’m not going to get into, but for the purpose of this guide, I’m going to use ‘Cydia’.

    Touch the ‘Cydia’ application.

    Once inside the ‘Cydia’ home menu, if you scroll down, you will notice an ‘OpenSSH Access How-To’ guide. Ignore it – mine is more comprehensive!

    Touch ‘Featured Packages’ on the home menu.

    Scroll down and touch ‘OpenSSH’. Now select ‘install’. Please be aware that this package does not have an icon, nor should it.

    Now, in order to use this package, we need to either SSH into the iPhone from a computer or SSH into your computer from your iPhone. Either way, the same data will be transferred from the iPhone to the computer. We do this by using a program that is already installed on our Macs called ‘Terminal’.

    3) Using ‘Terminal’

    Already installed on our Macs is a program called ‘Terminal’.

    ‘Terminal’ is an interface that allows the communication between two devices via SSH. It is located in the Mac HD/Applications/Utilities folder.

    We can also download it onto our iPhones through ‘Cydia’. In ‘Featured Packages’, there is a package called ‘MobileTerminal’. Install this if you wish to SSH into your computer from your iPhone.

    You have a choice to which ‘Terminal’ you use.

    We need to make sure that both the computer and iPhone are connected to the same internet network.

    Touch the ‘Settings’ icon on the iPhone and then touch ‘Wi-Fi’ and choose the correct network. While still on this screen, touch the arrow on the selected network and jot down the IP address of the iPhone. It will look like ‘’, for example.

    We also need the IP address of our computer. To find this, click on the Apple icon in the menu bar at the top of the screen. Select ‘System Preferences’ from the drop down menu. Select the ‘Network’ icon. You should see it under ‘Status’. Make sure that you have ‘Airport’ switched on and are connected to the internet, otherwise you won’t see the IP address.

    Now we can begin to communicate between our devices!

    Decide which ‘Terminal’ you want to use – the one on the computer or ‘MobileTerminal’ on the iPhone’. Each way will require a slightly different approach. Either way will do.

    SSH via computer:

    First of all, touch the ‘Settings’ icon on your iPhone.
    Touch ‘General’.
    Touch ‘Auto-Lock’.
    Touch‘ Never’ - this ensures that your iPhone’s screen remains lit. If it doesn’t stay lit, we will lose connection.

    Now, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
    Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.

    Open ‘Terminal’ on your Mac.

    The first line should say ‘Macintosh:~ Username$’
    The ‘Username’ will be your username.

    Here, we need to access the iPhone’s root folder.
    We do this by typing: ssh root@youriphone’sIPaddress
    Press return.

    It will now ask for a password.
    The password is ‘alpine’.
    Press return.

    You should now see ‘Yourname-iPhone:~ root#’

    Here, we access the iPhone’s root folder and instruct it to ‘dump’ it’s disk image onto your computer. The abbreviation for this is ‘dd’ or DiskDump. This will carve out an image of the iPhone’s Hard Drive in all of it’s dimensions and deposit it on your computer. To all intents and purposes, this is your iPhone’s Hard Drive.

    We do this by typing:
    dd if=/dev/disk0 | ssh username@Computer’sIPaddress ‘dd of=iphone-dump.img’

    You don’t need to name it ‘iphone-dump’. You can call it something else if you wish.

    Note: Be sure that you don't mix up the "if" (input-file) and "of" (output-file) in the command above. Doing so could wipe your iPhone.

    Press return.
    Enter your computer user password.

    You will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.

    The transfer could take several hours. Try and be close to your Internet router box.

    Progress stops at 15.12GB. This is my complete iPhone disk image.

    SSH via iPhone:

    Using this method, we needn’t worry about keeping the iPhone’s screen lit. For some reason, it doesn’t make any difference. I could offer a theory as to why, but at this juncture it doesn’t really matter.

    As before, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
    Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.

    Touch the ‘MobileTerminal’ application on the iPhone. Once open you will see:

    Yourname – iPhone:~ mobile$

    We need to now access the iPhone’s root folder. We do this by first typing ‘su’ (without the inverted commas).

    Then we type ‘alpine’ as the requested password.

    You should now see:

    Yourname-iphone:/var/mobile root#

    Here, type:

    dd if=/dev/disk0 | ssh username@Computer’sIPaddress ‘dd of=iphone-dump.img’

    as we did in the previous example and enter your computer username as the password.

    As before, you will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.

    The transfer could take several hours. Try and be close to your Internet router box.

    Progress stops at 15.12GB. This is my complete iPhone disk image

    The ‘Dead End’

    In order to access the disk image, we need to first mount it as a hard drive that we can access as we would any other hard drive. To my knowledge, this is the only way we can salvage the lost/deleted data using data recovery software.

    When I double-click on the ‘iphone-dump.img’ icon, a window tells me ‘no mountable file systems’. Okay, so no luck there. I tried several times but, alas, nothing more happened.

    I then high-lighted the image, went to ‘File’’ in the menu at the top of the screen and then to ‘Open With’. Here I selected ‘DiskImageMounter’ but, again, I got a window telling me ‘no mountable file systems’.

    I then went to open ‘Disk Utility’, which you will find in ‘System Preferences’. The problem here is that because it is only an image file (.img), it doesn’t appear as a drive to select. So, what I did was to again high-light the image, go to ‘File’ in the menu at the top of the screen and then to ‘Open With’. I selected ‘Disk Utility’. It will now appears as an icon to select. It is still, however, an ‘.img’ file. I then selected ‘Restore’ in the ‘Disk Utility’ window. This menu should restore a disk image to a disk, which is what we want. I dragged ‘iphone-dump.img’ into the ‘Source’ line and dragged whichever drive I wanted it to end up into on the ‘Destination’ line. Then I clicked the ‘Restore’ button. Unfortunately, I get ‘Restore Failure – Could not validate source. Corrupt image”.

    ‘Verifying’ or ‘Repairing’ the disk image also fails.

    I’ve also tried mounting it using ‘Terminal’ with the commands:

    hdiutil mount filename.dmg


    hdiutil mount filename.dmg

    and still nothing… just

    hdiutil: mount failed - No such file or directory

    I’ve also tried ‘converting’ it using the Disk Utility to a .dmg file, but this doesn’t get me any further.

    I’ve tried every which way to mount the image, including using third party mounting software such as ‘Mount.app’, ‘Stuffit’ etc, and it still won’t mount!

    I have transferred the disk image several times in order to rule out the possibility of a one-off transfer error.

    I have found other people on a couple of forums having exactly the same problem: for example:


    Help Anyone???

    Is anyone out there able to help me? Any super-techies in shining armour?

    Am I overlooking something or is it simply that the disk image is corrupted?

    Is there a way of comparing the disk image with the hard drive on my iPhone so I can see if anything has altered in the transfer? I’m finding it very difficult to find anything that explains how I would do it.

    I’ve worked out how to ‘Checksum’ the ‘iphone-dump.img’. I did this by high-lighting the disk image, going to ‘Finder’ in the menu bar, going to ‘Services’ in the drop down menu, going to ‘Disk Utility’, and then selecting one of the two ‘Calculate Checksum’ options. I was able to view the calculated ‘Checksum’ (and it being calculated) by opening ‘Disk Utility’ and clicking on the ‘Log’ icon in the top right hand corner. I’m not yet sure which ‘Calculate Checksum’ option is relevant or what to do with the calculated ‘Checksum’ once I’ve got it.

    Am I able to obtain some sort of code from the iPhone that represents it’s hard drive, therefore allowing me to compare it to a code that represents the ‘iphone-dump.img’? I think we call this a ‘Hash Value’.

    If the image is corrupt, am I able to repair it manually somehow by altering the corrupt code to the correct code obtained from the iPhone?

    I just don’t know!!!!! Is it more simple than I’m making out to be?

    Does anyone have any ideas???
  2. foob macrumors 6502


    Feb 17, 2009
    I'm a Linux guy so I can't help much with the mac stuff. But...
    It would be impossible to get a checksum to come out the same on a running system (the phone) because things are constantly changing. Every bit on the drive goes through a mathematical algorithm to get a checksum. With a good algorithm, a single bit will cause it to mismatch and a running drive is constantly writing data.

    In data recovery, it is best to unplug the drive so nothing can be written any further, mount it read only, then copy or try to recover data. But that's probably not possible without removing the memory on an iphone, so you're doing the best you can with dd if/of.

    There has probably been a lot of data written to the phone during the upgrade. It's possible the data you're trying to recover has been overwritten. But keep going. Even if you can't recover it all, you may get some, and it's a nice guide that you should complete as well.
  3. atomic hooligan thread starter macrumors newbie

    Jul 4, 2009
    I found a way to sort of mount the drive and consequently do a data recovery.

    What i did was highlight the 'iphone-dump.img' and opened it with 'Disk Utility'. Inside of 'Disk Utility', I double-clicked the 'iphone-dump.img' icon and low and behold, it split into two drives, despite it giving me an 'Unable to attach 'iphone-dump.img' (no mountable file systems)' message at the same time.

    I wasn't able to do much with it in 'Disk Utility' from there on, so I opened 'Data Rescue II' and it became available to scan as a 'Virtual Interface' called 'Apple read:write'. I performed a scan and was able to locate my missing photos. It took a while because there were several duplicates of older photos. I think this is because each time I've restored the phone from a backup, data has been placed in a different location on the hard drive. Therefore, it has not overwritten these very same photos that have been on most of my backups for some time.

    I wasn't able to find my missing voice memos from the 'QuickVoice' application though. They appear not to be there. I found the existing ones from the recovery. They must be somewhere surely? Maybe the photos are stored in a different way since the photo application is a default app and 'QuickVoice' is a bought app.

    Ideas anyone?
  4. air.male macrumors newbie

    Oct 14, 2009


    I am able to get to the step of connecting to the iphone but after I type into the terminal the step to make the iphone-dump.img i'm asked for a password.

    Not sure which password it's reffering to as i've tried my mac's & iphone's password/pascodes.

    After 3 attempts, i'm then asked for my computers password which I enter but receive "Permission denied, please try again." until the 3rd time when I receive "Received disconnect from (computer's IP) Too many authentication failures for (computers Username)"

    NB the contents in the brackets () are the IPs and computers actual name etc.

    Any help?
  5. rerg15 macrumors newbie

    Dec 30, 2009
    Thanks!! and a couple of questions.

    This is easily the most comprehensive guide i've found in order to potentially recover lost data that hasn't been backed up from an iPhone (and hopefully iPod touch as well)

    Yesterday as I connected my iPod touch to my computer as usual, iTunes wouldn't recognize it, saying nothing could be written nor read from the device! Next thing I knew, all my music was gone... which honestly I didn't care about so much, because I have it all copied in my library folder.

    I tried restarting iTunes, unplugging and plugging the iPod back and forth, switching USB buses but iTunes kept saying that a Restore is the only thing that could fix the problem. It didn't give me any other choice. So i documented myself, before doing so in order to make sure I wouldn't lose the rest of my data, such as contacts, notes, apps, calendar entries, etc. This is the first time I ever Restored my iPod so I didn't quite know how it usually goes and I read that iTunes will always backup your stuff every time you connect your device AND that they would ask if I wanted to back up before Restoring... which never happened. Couldn't back up at all. Didn't have the option, but I thought it would be saved somehow, somewhere.

    So I Restored, hoping they would offer me the option to re-install everything back at the end of the whole process. Again, it kept saying I would have the chance to restore my former settings and stuff.

    Boom, the Restore is done, everything gone, the iPod's reset to scratch, no backup, no option to restore my former settings, to my BIG FAT grief.

    Called Apple, they said nothing could be done if there's no backup. Went to apple store today, same thing. I've been doing lots and lots of research online, getting data recovery software, but most of them only work for the regular iPods, even though some are advertised to work on iTouch and iPhone as well, total B.S. And I also found the kind of software you mentioned, that allow you to use the device as a hard drive inside the program, but don't really mount it as an actual HD unto the computer.

    The only reason I still have hope to recover what I lost is because I read on the manual that once you delete data by updating or restoring the software, the information isn't REALLY erased, but simply no longer accessible by the interface, just as you mentioned. Which led me to cease all use of my iPod since, for fear of overwritting anything recoverable.

    Here's the quote from the Manual:

    "Note: In some cases, an update may also include restoring iPod touch.
    • If you restore, the latest version of iPod touch software is reinstalled, settings are restored to their defaults, and data stored on iPod touch is deleted, including downloaded applications, songs, videos, contacts, photos, calendar information, and any other data. If you’ve backed up iPod touch with iTunes on your computer, you can restore data from the backup at the end of the restore process.
    Deleted data is no longer accessible via the iPod touch user interface, but isn’t erased from your iPod touch. For information about erasing all content and settings, see “Resetting iPod touch” on page 122."

    Basically, to really erase the information from the memory you need to manually reset the device through the settings, etc.

    And then I ran into your article, which is the only thing that's given me hope so far. But at this point, my only concerns are:

    I know this may sound very stupid, since this is a Mac forum, but honestly, is there any hope for PC users like me in your opinion??



    This is where I'm stuck. It would really mean the world if anyone can help me get past this point with positive solutions, in which case I will do wtv it takes to recover my lost data.

    THank you very much.
  6. TriJetHero macrumors 601


    Oct 13, 2010
    3 1/2 years later i guess he would have found out by now....
  7. dhlizard macrumors G4


    Mar 16, 2009
    The Jailbreak Community
    The thread starter has been waiting all this time for this answer ....

    Or maybe not ! :rolleyes:

    Attached Files:

Share This Page