5 Procedures to Recover Deleted Data on iPhone

iOS Unless you have a backup in the operating system, locally or in the cloud, you are unlikely to recover any random data. However, even if you do not have a random backup, there are some systems that allow you to recover your data. iPhone users have the good fortune to recover the data types we will discuss below, provided reasonable conditions are met.

1. Deleted Records from SQLite Databases

Apple stores many types of user data in various databases. SQLite format. a user; from the Messages app iMessage, a Safari deletes a random record such as a bookmark or a history item, that record is not quickly deleted in the SQLite database for performance considerations. Instead, the SQLite engine marks the record as “deleted”, marks the page as unused, and adds a reference to the “free list”. Such deleted records can be stored in SQLite “free lists” for a while, allowing data recovery tools to attempt to recover the data.

This method of recovering a random data from the SQLite database only works if:

  • You should have been able to extract the affected SQLite database with a low-level extraction tool. (For this, your device jailbreak or use Elcomsoft iOS Forensic Toolkit. )
  • The database itself must not have been cleaned or merged. Because when one of these two situations occurs randomly, the deletion process becomes permanent.
  • You should be fast enough and remove the affected database within seconds after the record is deleted. for iOS 12

    Since , the system permanently deletes records quickly after deletion. For this reason, we have to say that it is not possible to recover deleted SQLite records in iOS 12 and newer versions.

Long story short, the procedure to recover data from SQLite no longer applies to deleted iMessages, Safari bookmarks, tabs, and history or other types of data stored in SQLite databases.

2. Information Inside WAL Documents

As we mentioned above, even the latest versions of iOS quickly clean SQLite databases, preventing the recovery of deleted records (messages, call logs or contacts). However, SQLite databases have another feature that will allow you to recover your data. SQLite, new records WAL documents

amount in . If such unmerged records are deleted, they are retained in the corresponding WAL documents until they are merged with the master database. This means that some records that have been deleted and not merged can be recovered.

A way to recover any random information stored in WAL documents only works if:

  • You must have low-level access to the documentation system. (For this, you need to jailbreak your device or use Elcomsoft iOS Forensic Toolkit.)
  • WAL documents should still be unassembled.
  • A between the time the record is deleted and the time to remove iTunes you must not have created a backup. Because as soon as you start creating an iTunes backup, WAL documents are merged with the relevant master databases and deleted records are lost. However, media documents are an exception to this bet. When extracting media documents (from any device, including iPhone, iPad, Apple Watch, and Apple TV models) via the iOS Forensic Toolkit, you also get unmerged WAL documents. This allows some image meta information to be recovered.

3. Information Retained in Former Local Reserves

If you have a local backup, the real issue here is how to access the information without restoring the entire backup on some iOS device. There are numerous tools on the market, including the Elcomsoft Phone Viewer, that allow to parse the contents of local backups, view or extract individual documents and database records (for example, messages or log entries).

However, keep in mind that you can access more information if your iTunes backup is password protected. While it’s too late to set a password for data recovery purposes, it is invaluable for you to set a strong backup password for security purposes.

4. Data Found in Old iCloud Backups

This data recovery technique is similar to the previous one, but it is not exactly one-to-one. If you have cloud backups, you may have old copies of your information that you can download with Elcomsoft Phone Breaker and analyze with Elcomsoft Phone Viewer. Especially Apple, the last two iCloud saves your backup (there used to be three), making it possible to download the oldest.

iCloud backup also has other differences compared to local backups. NS iCloud Photo Library

If you enable , your iCloud backups do not contain photos (there is a manual override for this setting). Also, depending on your sync settings and your device’s iOS version, they also don’t include other types of synced data. Likewise, iCloud backups do not include any of the following:

  • Keychain *
  • Health data
  • House information
  • iCloud Photos **
  • Messages **
  • Since iOS 13: Invitation logs
  • Since iOS 13: Safari history

* Actually, the keychain is included in iCloud backups, but is encrypted using a device-specific key. You won’t be able to access keychain items from iCloud backups unless you do a full-to-device restore.

** Messages are not included in iCloud backups unless iCloud syncing of these categories is enabled in device settings. Photos has a manual override feature that allows you to keep both synced and backup versions.

5. Synchronized Information

iPhones can sync many types of data with iCloud. However, this requires synchronization to occur in real time or very close to it. In such cases, everything you delete from your iPhone will be deleted from the cloud, but of course, there are some exceptions to this. If your iPhone isn’t connected to the internet midway between deleting a syncable item and trying to recover that data, that means you can most likely recover that information. However, even after a period of time, synchronization delays may occur, allowing for recovery.

There are also some exceptions regarding the retention period of the information you delete in iCloud. Some categories (including photos and notes, but there may be others) remain available in iCloud for a long time (usually about 2 or 3 weeks) after they are removed from the deleted folder. In fact, a few years ago, Apple kept such documents indefinitely.

Why Can’t You Recover Documents You Deleted From Your iPhone?

Even if you have access to the documentation system, you cannot free up space to search for deleted data. Because Apple iOS 4

Since it has been encrypting the document system and iOS 8

Since , encryption keys are based on the user’s password. So the documents on the user side (images, SQLite databases and stuff like that) are encrypted. Moreover, each document is encrypted with a different key, which will be deleted soon after you delete the document.

iOS documentation system (Apple, mid-devices APFS

uses ; some older iOS 10.3 devices HFS+

(they use has the following features:

  • Quickly everything is encrypted.
  • Each document is encrypted with its own unique key.
  • All encryption keys are encrypted with another public key.
  • This public key is calculated when users enter their passwords during the first unlock.

After a random document is deleted, iOS also deletes the corresponding document key from the document’s metadata. As a result, you cannot decrypt the document without the document key, even if you read the data blocks that previously contained the deleted document.

If you return your device to its default settings (“Erase all information” option), the “Erasable Storage” will be deleted, which will cause the public key to be destroyed. Even if the NAND storage is not wiped, this alone makes the data undecryptable and inaccessible.

Leave a Reply

Your email address will not be published. Required fields are marked *