iPhone 3GS data recovery
Sometimes, when you just hang around on the beach, you prefer your handy iPhone companion rather than a full-featured reflex camera.
I’ve been spending one week in the Maldives lately, and shot more then 300 pictures and videos. The Maldives is also a great place to see sharks and stingrays. So with the help of a ziploc bac (!), I managed to take great underwater videos with the iPhone too.
On the flight home and after a week wihout The Internet, I simply wanted to look at the previous week’s latest news. I started Byline, which is so far the best iPhone RSS feed reader on the AppStore. I had unfortunately set Byline to cache all new items. A week is a lot to cache. I found a Wifi network at the transit airport and launched the sync.
As my iPhone was packed with songs and applications - just in case the Maldives would have been a boring place (silly idea, i know). Byline quite naively thought it would be ok to cache 1300 news items and their associated pictures.
Disk full, Byline crashed, reboot, stuck to Apple logo.
I had already bricked my iPhone a few months before, and even if it was stuck on the Apple logo, I always refused to restore and prefered to wait, power plugged, sometimes rebooting, toggling to restore, then rebooting. Last time it worked, this time not.
When I finally got home, I plugged the iPhone on my Mac and fired iTunes in order to know if any sync operation was possible but that was quite naive. As I had to take the train a few hours later, I decided to restore and to rewrite the least content I could in order not to overwrite data - useless, as I learned later that disk writes are made in a random fashion, every sync operation after the crash is like firing an AK47 on your data.
I happen to have access to data recovery software, so why not just mount the iPhone as a thumb drive?
Sorry folks, this doesn’t work. On the Windows side, the iPhone mounts as a camera, you can’t do anything else as copy/paste. If you’d like to “explore” your iPhone, iPhoneExplorer (Windows) and DiskAid (Mac) will work, but they are useless in this case. Neither can they mount the iPhone or restore deleted data.
A few other solutions exist, but developers seem to have flown to other projects, since iPhile or iPhoneFS are just crashing on Windows just when you start the app. On the Mac side, iPhoneDisk is kind of a dead project.
Well, Apple, you made things pretty tough for me, let’s jailbreak.
I finally found something interesting, I’m really not alone in my painful recovery attempt. There seem to be a way to dump iPhone’s image on your computer for later recovery, using a terminal command. I followed those steps:
- jailbreak with redsn0w
- cydia install
- openssh, netcat and mobile terminal install
- recovery attempt using dd and nc commands.
Here is the code of what I’ve done:
Last login: Tue Aug 18 23:52:16 on ttys000
OSX-JULIEN:~ Ju$ ssh root@192.168.2.5
root@192.168.2.5’s password:
Blueberry:~ root# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/disk0s1 750M 536M 208M 73% /
devfs 27K 27K 0 100% /dev
/dev/disk0s2s1 30G 17G 13G 58% /private/var
Blueberry:~ root# mount
/dev/disk0s1 on / (hfs, local, noatime)
devfs on /dev (devfs, local)
/dev/disk0s2s1 on /private/var (hfs, local, noatime)
Blueberry:~ root# /bin/dd if=/dev/disk0s2s1 bs=4096 | nc 192.168.2.4 7000
/bin/dd: opening `/dev/disk0s2s1’: Resource busy
Blueberry:~ root# /bin/dd bs=4096 if=/dev/disk0s2s1 | ssh Julien@192.168.2.4 ‘dd of=iphone-dumpz.img’
/bin/dd: opening `/dev/disk0s2s1’: Resource busy
Password:
0+0 records in
0+0 records out
0 bytes transferred in 0.000034 secs (0 bytes/sec)
Blueberry:~ root#
Not successful at all.
The two original discussions on modmyi.com:
Recovering Lost/Deleted Data From An iPhone That Has Not Been Backed Up
3GS 3.0 disk image dump failure leads to a brand-new iPhone user’s tale of rage & woe
A user from this forum managed to to it, here it goes for the command:
The whole shebang:
ssh user@iphone-ip dd if=/dev/rdisk0 bs=1M | dd of=iphone-dump.imgJust the system partition:
ssh root@iphone-ip dd if=/dev/rdisk0s1 bs=1M | dd of=iphone-root.imgJust the user data partition:
ssh root@iphone-ip dd if=/dev/rdisk0s2s1 bs=1M | dd of=iphone-user.img
Replace iphone-ip by your iPhone’s IP, if asked for a password, enter alpine.
And it did work for the user data partition! It took about 8hours to get the image dumped on my 32GB iPhone 3GS.
Two tips to get it done correctly:
- have a terminal command sending pings to the iPhone in order not to lose the connection
- set the Auto-Lock feature to “never” in Settings>General>Auto-Lock - otherwise you’re connection will drop while on the lock screen
Next post: How to actually recover the files from the disk image. I’ll probably use Disk Warrior.
If you have any questions, please contact me.
Read next: iPhone - recover your lost photos and videos
