2

I have limited iCloud back-up. I have no iTunes back-up.

Before IOS 12 recovering data after reset is very easy. After IOS 13 it becomes more difficult.

So, for professional engineers, is it now still technical possible to recover lost data in the hard drive of IPhone 11 64GB?

I only need the apple "Note". I thought I have all my valuable notes back-up online, so I erase the phone. But later I found out that my Cloud is full.

3
  • The hardware determines the encryption capabilities of the flash controller. From which hardware are you trying to recover data? Also, if you can state your budget for recovery, that helps people suggest the correct level of effort and tools. drivesaversdatarecovery.com
    – bmike
    Mar 29, 2022 at 9:57
  • @bmike This is IPhone 11 64GB. Just some hint on the technical possibility will help. If it is impossible after IOS 13 then I won't give it a try. Thanks again!
    – dodo
    Mar 29, 2022 at 10:18
  • Will do, I’ll try to summarize some key points for you to consider. They’re always a chance you can beat the odds…
    – bmike
    Mar 29, 2022 at 10:56

2 Answers 2

14

No, this is not possible for any practical scenario.

It is also totally false that this was "very easy" before iOS 12.

This is basically a duplicate of your other question here:

How to copy all bytes of a phone (formatted or not, 64GB/64B) into a computer hard drive?

where I detailed in lengths why it is not practically possible.

It being practically impossible has nothing todo with snapshots, disassembly of the device or how solid state storage differs from tape or hard drive storage.

It is all entirely down to the fact that the data was encrypted with the AES-256 encryption algorithm using a key derived from information that was previously stored exclusively within the Secure Enclave in that phone - and now gone. There's no practical way of getting that key from the Secure Enclave now, and there's no practical way of breaking the encryption with the key gone.

The data is lost for you.

Just to answer your previous counter-arguments from the older question:

  1. No, that newer and faster computers are released every year will not change the fact that the data is lost.

  2. No, that you have 1000 years of time on your hands for brute forcing will not change the fact that the data is lost.

  3. No, that you have access to "Apple coders" with "secret information" about the encryption will not change the fact that the data is lost.

  4. No, even IT-professionals will not be able to get your data back from that data storage on the phone.

Your only realistic way to get your data back is to hope you have a backup somewhere. Look for old backups, old revisions of data stored in iCloud, perhaps you've sent the note via text to somebody else earlier - things like that. From your descriptions, I would take a closer look at older iCloud backups of your phone, as well as look at iCloud.com to see if your Note should be synchronized there afterall.

There's also the theoretical possibility that we covered on the other question - namely that you suddenly make a world-class break through in the state of code breaking and find a major weakness in the AES-algorithm that allows you to decrypt the encrypted data quickly without having the key. In that case, you would probably be able to make so much money and fame off of having that new insight that you wouldn't be thinking about recovering data from your decades old iPhone at that point.

In addition, there's a theoretical possibility that it is later discovered that Apple is using weakened encryption - for example due to being strong-armed in to doing so by the US government. If that is revealed in years to come, then it might so happen that someone figures out how to break that weakened encryption in a practical timeframe. I would discount this as being a very theoretical possibility. It is not practical. I would rather spent that time and energy on buying a lottery ticket basically.

10
  • 1
    Backdoors in iOS system won't help you get the data back. An weakness in the iOS-version of AES is basically pointless to hope for. Finding a major weakness in AES ever is also basically pointless to hope for.
    – jksoegaard
    Mar 29, 2022 at 14:11
  • 1
    Something between your list: it is a condensed 100 pages of my research note. There are also many SmartPhone Forensic Systems, used primarily by law-enforcement agencies, claiming to be able to recover erased data. Perhaps they cannot recover the data after a reset, as you suggested.
    – dodo
    Mar 29, 2022 at 14:40
  • 1
    This is your claim - I guess you probably cannot name even one of those many systems. There are no systems that law enforcement agencies can use to recover erased data from an iPhone 11 that has been reset. If the phone hasn't been reset, but only a file deleted - it is still not possible. You can be lucky that the user didn't actually fully delete it, but it is in a Trashcan or Recently Deleted folder - but not really the same thing. The only real exceptions are data that is not deleted, but rather marked deleted in a file that is handled by the app itself - such as SQLite databases [...]
    – jksoegaard
    Mar 29, 2022 at 15:57
  • 1
    [...] that are improperly handleded (i.e. they're not vacuumed after delete, or they leak data through write-ahead logs or similar). But all that is on the application side - not on the iPhone's operating system in general.
    – jksoegaard
    Mar 29, 2022 at 15:59
  • 3
    Sorry to say it, but that note is already lost. As I wrote in the answer, you need to look for secondary sources - such as old backups, iCloud.com, etc. - anywhere you might have synchronized or copied the note to. The original note on your iPhone is irrevocable gone.
    – jksoegaard
    Mar 29, 2022 at 18:26
4

Yes, until the storage is over written the encrypted data exists still. This recovery you contemplate is by no means trivial due to several factors.

  • you have likely lost access to a key you never had stored off the device to decrypt the data
  • multiple snapshots of the filesystem were likely present, which may make your recovery software or analysis of captured data less useful than you hope if you managed to guess or reconstruct the key
  • disassembly of the device is usually needed to begin efforts that are reasonably likely to be effective at dumping the raw encrypted data
  • solid state storage is not the same as tape or hard drive data storage and this further complicates recovery once you overcome all the above factors

As a practical matter, the data is well gone unless you bring sufficient technical skills to bear on your problem of not having a backup. Skills and tools that worked for magnetic rotational hard drives don’t translate directly to iPhone hardware design.

3
  • 2
    In other words: theoretically possible, but you need expensive hardware, specialized software, and expensive people. But all is moot if you don't have the key (which you never had access to in the first place). So the chance to recover some data is not zero, but very, very close to it.
    – DarkDust
    Mar 29, 2022 at 12:22
  • 3
    @DarkDust Theoretically possible, given more time than the age of the universe. Making the other criteria (hardware, software, people) kind of irrelevant…
    – nohillside
    Mar 29, 2022 at 12:41
  • 3
    And hundreds of thousands of reasons to report this to Apple or get a job with an organization with deeper pockets than Apple if you were to figure a way around this - developer.apple.com/security-bounty/payouts
    – bmike
    Mar 29, 2022 at 14:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .