Follow

Can I recover deleted data on an iOS device?

Created by: Brendan Bone
Created date:
Last Updated date:

Yes and no.

Deleted user data (SMS, call history, contacts, etc.):

These data types are stored in SQLITE databases. Typically, when a user selects to delete one of these data types, the corresponding database entry is dropped from the appropriate database. However, any text associated with that entry may still persist, without structure, in the database's free space until the phone decides to cleanup and vacuum the database. If you an image of an iOS device, you can right-click these SQLite files and select "Parse Database for Deleted Data" to carve for deleted data within them. Even logical images of iOS devices contain many of these SQLite database, allowing you to find deleted data.

The "Deleted" button in the Main toolbar can also be used as a shortcut to automatically find and carve the appropriate SQLite files for deleted SMS and Call History. However, this shortcut may not work with all devices.

Deleted files (old file versions from factory resets, photos taken with the camera, etc.):

All Apple mobile devices shipped with or restored to iOS 4 or later employ file-level encryption for most files on the device. It is nearly impossible to find and carve out these files after they are deleted. This is not a limitation of our software but is because Apple removes the key files from the device for files in unallocated space. You can, however, still attempt to carve for and find unencrypted files within the file system. On legacy and pre-iOS 4 devices, file carving will yield more results. This limitation imposed by Apple should not stop you from attempting a recovery, but should explain why recovery cannot be accomplished on certain devices.

Was this article helpful?
1 out of 1 found this helpful
Have more questions? Submit a request

Comments

Powered by Zendesk