Recovering Lost/Deleted Data From An iPhone That Has Not Been Backed Up

[atomic hooligan]

Hello People!


Welcome to my near-complete dummies guide to recovering lost/deleted application data from your iPhone that have not been backed up – first generation, second generation, but not iPhone 3GS.

I am looking for someone who can complete the final step.

Please, if anyone fancies a challenge, follow my instructions and meet me at the final wall I’m up against.

Feel free to submit corrections or suggest improvements.

I own an iPhone 3G and I am running OSX Leopard on my iMac.

You will need an up-to-date version of iTunes.


The Problem

Many with iPhones have been there. It’s incredibly frustrating and answers seem few and far between. It’s so easy to unintentionally delete a file and yet to recover it appears impossible.

However which way one loses their application data, my thought was that there must be some way to recover this information.

I began this crusade when I lost all of my photos, and important voice memos from Quick Voice. This happened recently when iTunes automatically updated my iPhone's firmware to OS 3.0.

I hadn't synced my phone in some time and so this data hadn't been backed up.

I then went on to do an exhaustive search on forums and any other websites that seemed sympathetic to my cause. It quickly dawned on me that it wasn’t going to be easy since there weren’t really any clear comprehensive guides to resolving this sort of problem; just bits and pieces.

Thankfully, I brought together enough information to get as far as the last hurdle.


This is my guide so far:

First of all, why does the lost/deleted data still exist even though it appears to have gone?

In practically every hard drive there is ‘deleted’ data that can be recovered. When a file is deleted, it is not immediately removed from the hard drive. There is a section of the hard drive that is similar to a ‘Table of Contents’ and when a file is deleted it is removed from this ‘Table of Contents’. The original deleted file is left as dead space on the hard drive. Since the file still exists on the hard drive, special tools that bypass the ‘Table of Contents’ can be used to search for files and potentially recover them. These are data recovery tools.

However, the computer no longer has instructions that forbid it to overwrite this data, and so the more it is used the more likely new files will overwrite older files.

A computer writes files every time a program is used. This includes standard Internet accesses and even an operating system will overwrite certain files every time a computer is powered on. These files are not very large but they account for a significant percentage of the destruction that occurs to recoverable files. This is an excellent reason to stop using a computer as soon as it is learnt that data has been lost.

Files are generally written consecutively until it reaches the end point of the hard drive, at which point it will begin filling in the dead space from the beginning, and so on and so forth.

A file can be divided into several pieces and exist in various locations on a hard drive. Because of this, it is possible that only part of a file will be recovered. The longer it is since the files were deleted, the less probability that something can be recovered. In some instances, data has been recovered dating back several years.


Recovering data on a standard Hard Drive

To recover lost/deleted data from a standard hard drive we use ‘data recovery’ tools. One such tool is ‘Data Rescue II’ – a fantastic piece of software that I thoroughly recommend.

I have had to recover lost data before and so it a process I am familiar with. When recovering data from a standard hard drive, the process is relatively straightforward. You select the drive to scan and the software does the rest. From there, you search through the recovered files until you find the one you are after.


The problem with recovering data from an iPhone

Although we can access the iPhone and iPod Touch via iTunes, it does not mount on the desktop as a hard drive. Hence, it does not appear as a drive that we can scan with data recovery software. Apple have decided not to allow this since it takes away a lot of their power as a sole provider. This will become apparent as you read on.

From what I’ve gathered, in order to recover lost data from the iPhone, we need to mount the iPhone as a hard drive.

Now, there is a piece of software called ‘Phone View’. Although great - allowing you to access existing application data through a Finder menu and transfer otherwise non-transferable data to and from the iPhone – it doesn’t mount the phone as a drive.


The (nearest-dammit) solution to mounting the iPhone

I wasn’t able to find much about mounting the phone via USB but I was able to find information about mounting it wirelessly.

Most forums give a lot of baffling information that, to the layman, is, well… baffling! I will attempt to cut the ‘geek-speak’ and boil it down to plain, necessary English.

1) Jailbreak the iPhone

First of all we need to ‘Jailbreak’ our iPhone. In brief, this means it will allow you to install 3rd party applications. This applies to all versions of firmwares (OS 1.0, 2.0, 3.0 etc).

This is not the same as ‘unlocking’, which refers to the process of opening up your iPhone to accept SIM cards from all carriers.

There are two partitions on the iPhone:

The first partition is 300 MB in size and is the system or root partition (not to be confused with the root folder which will be seen in the second partition). This partition contains the Operating System and the default applications that are delivered with a factory fresh iPhone. This partition is designed (unless ‘Jailbroken’) to be in this pristine state for the life of the phone.

The remaining space of the hard drive is partitioned as the user-space (or media) partition. This space is where all music, videos, contacts, SMS etc are stored.

Note: The Jailbreak and subsequent firmware customisation are reversible simply by restoring the iPhone in iTunes!

We need to first download the official bit torrent to obtain the jailbreak software. The software I used is called ‘PwnageTool 3.0’ created by the ‘Dev-Team’. The bit torrent can be found on the ‘Dev-Team Blog’:

http://blog.iphone-dev.org/post/126465561/trois-drei-h-rom

Or we can download it directly from:

http://torrents.thepiratebay.org/4963802/PwnageTool_3.0.dmg.4963802.TPB.torrent

We need a file-sharing client in order to download the software from the bit torrent, such as ‘BitTorrent’, ‘Limewire’, ‘Gnutella’, or equivalent, which will automatically load when you double-click on the bit torrent download.

The software will be downloaded as a ‘Disk image’ called ‘PwnageTool_3.0.dmg’.

A ‘Disk Image’ is a single file or storage device containing the complete contents and structure representing a data storage medium or device, such as a hard drive, floppy disk, CD, or DVD. A disk image is usually created by creating a complete sector-by-sector copy of the source medium and thereby perfectly replicating the structure and contents of a storage device.

Double-click on this image to mount the disk as a drive on your desktop. Also, there will now be an icon that looks like a white piece of lego with a title beginning ‘iPhone1,2_3.0…” – this is an update file that will customise the OS 3.0 firmware. We will get to that part later.

Double-click on the newly mounted ‘PwnageTool’ drive.

Then, double-click on the pineapple icon now visible in the Finder window.

Follow these instructions, superbly explained by a kid in this MetaCafe link:

http://www.metacafe.com/watch/yt-fXedsWr6_PE/how_to_jailbreak_3_0_firmware_using_pwnage_tool_fo r_iphone_3g_iphone_ipod_touch/

Or follow this excellently written guide:

http://www.modmyi.com/forums/iphone-news/635661-how-jailbreak-iphone-firmware-3-0-pwnagetool.html


2) SSH’ing – Connecting iPhone to a computer wirelessly

Great! What we need to do now is something called ssh’ing!

In brief, SSH (or Secure Shell) is a ‘network protocol’ that allows data to be exchanged using a ‘secure channel’ between two networked devices.

A ‘network protocol’ is a set of rules used by computers to communicate across a network allowing data transfer.

A ‘secure channel’ is a way of transferring data that is resistant to interception and tampering.

The two networked devices in this instance are the computer and the iPhone.

The network in this instance is the Internet. So, we will be using an ‘Internet Protocol’ or IP.

In order to do this, we need to download something on our iPhone called ‘OpenSSH’.

Right, so… now that our phone has been ‘Jailbroken’, you will notice two new applications titled ‘Cydia’ and ‘Icy’.

‘Cydia’ and ‘Icy’ are basically iTunes Store equivalents for unofficial third party applications.

There are many arguments to which one is better, which I’m not going to get into, but for the purpose of this guide, I’m going to use ‘Cydia’.

Touch the ‘Cydia’ application.

Once inside the ‘Cydia’ home menu, if you scroll down, you will notice an ‘OpenSSH Access How-To’ guide. Ignore it – mine is more comprehensive!

Touch ‘Featured Packages’ on the home menu.

Scroll down and touch ‘OpenSSH’. Now select ‘install’. Please be aware that this package does not have an icon, nor should it.

Now, in order to use this package, we need to either SSH into the iPhone from a computer or SSH into your computer from your iPhone. Either way, the same data will be transferred from the iPhone to the computer. We do this by using a program that is already installed on our Macs called ‘Terminal’.


3) Using ‘Terminal’

Already installed on our Macs is a program called ‘Terminal’.

‘Terminal’ is an interface that allows the communication between two devices via SSH. It is located in the Mac HD/Applications/Utilities folder.

We can also download it onto our iPhones through ‘Cydia’. In ‘Featured Packages’, there is a package called ‘MobileTerminal’. Install this if you wish to SSH into your computer from your iPhone.

You have a choice to which ‘Terminal’ you use.

We need to make sure that both the computer and iPhone are connected to the same internet network.

Touch the ‘Settings’ icon on the iPhone and then touch ‘Wi-Fi’ and choose the correct network. While still on this screen, touch the arrow on the selected network and jot down the IP address of the iPhone. It will look like ‘192.168.0.100’, for example.

We also need the IP address of our computer. To find this, click on the Apple icon in the menu bar at the top of the screen. Select ‘System Preferences’ from the drop down menu. Select the ‘Network’ icon. You should see it under ‘Status’. Make sure that you have ‘Airport’ switched on and are connected to the internet, otherwise you won’t see the IP address.

Now we can begin to communicate between our devices!

Decide which ‘Terminal’ you want to use – the one on the computer or ‘MobileTerminal’ on the iPhone’. Each way will require a slightly different approach. Either way will do.

SSH via computer:

First of all, touch the ‘Settings’ icon on your iPhone.
Touch ‘General’.
Touch ‘Auto-Lock’.
Touch‘ Never’ - this ensures that your iPhone’s screen remains lit. If it doesn’t stay lit, we will lose connection.

Now, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.

Open ‘Terminal’ on your Mac.

The first line should say ‘Macintosh:~ Username$’
The ‘Username’ will be your username.

Here, we need to access the iPhone’s root folder.
We do this by typing: ssh [email protected]’sIPaddress
Press return.

It will now ask for a password.
The password is ‘alpine’.
Press return.

You should now see ‘Yourname-iPhone:~ root#’

Here, we access the iPhone’s root folder and instruct it to ‘dump’ it’s disk image onto your computer. The abbreviation for this is ‘dd’ or DiskDump. This will carve out an image of the iPhone’s Hard Drive in all of it’s dimensions and deposit it on your computer. To all intents and purposes, this is your iPhone’s Hard Drive.

We do this by typing:
dd if=/dev/disk0 | ssh [email protected]’sIPaddress ‘dd of=iphone-dump.img’

You don’t need to name it ‘iphone-dump’. You can call it something else if you wish.

Note: Be sure that you don't mix up the "if" (input-file) and "of" (output-file) in the command above. Doing so could wipe your iPhone.

Press return.
Enter your computer user password.

You will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.

The transfer could take several hours. Try and be close to your Internet router box.

Progress stops at 15.12GB. This is my complete iPhone disk image.

SSH via iPhone:

Using this method, we needn’t worry about keeping the iPhone’s screen lit. For some reason, it doesn’t make any difference. I could offer a theory as to why, but at this juncture it doesn’t really matter.

As before, open up ‘System Preferences’ from the Apple symbol drop down menu at the top of the screen.
Select the ‘Sharing’ icon and then tick ‘Remote Login’. Communication between the devices will not be possible otherwise.

Touch the ‘MobileTerminal’ application on the iPhone. Once open you will see:

Yourname – iPhone:~ mobile$

We need to now access the iPhone’s root folder. We do this by first typing ‘su’ (without the inverted commas).

Then we type ‘alpine’ as the requested password.

You should now see:

Yourname-iphone:/var/mobile root#

Here, type:

dd if=/dev/disk0 | ssh [email protected]’sIPaddress ‘dd of=iphone-dump.img’

as we did in the previous example and enter your computer username as the password.

As before, you will not see a progress bar for the disk image transfer. To check it's progress, first open up a Finder window and click your 'Home' file on the left hand side. Hopefully, you should see a ‘iphone-dump.img’ icon. Highlight the image and 'Get Info'. Each time you check, you should see a larger file size.

The transfer could take several hours. Try and be close to your Internet router box.

Progress stops at 15.12GB. This is my complete iPhone disk image


The ‘Dead End’

In order to access the disk image, we need to first mount it as a hard drive that we can access as we would any other hard drive. To my knowledge, this is the only way we can salvage the lost/deleted data using data recovery software.

When I double-click on the ‘iphone-dump.img’ icon, a window tells me ‘no mountable file systems’. Okay, so no luck there. I tried several times but, alas, nothing more happened.

I then high-lighted the image, went to ‘File’’ in the menu at the top of the screen and then to ‘Open With’. Here I selected ‘DiskImageMounter’ but, again, I got a window telling me ‘no mountable file systems’.

I then went to open ‘Disk Utility’, which you will find in ‘System Preferences’. The problem here is that because it is only an image file (.img), it doesn’t appear as a drive to select. So, what I did was to again high-light the image, go to ‘File’ in the menu at the top of the screen and then to ‘Open With’. I selected ‘Disk Utility’. It will now appears as an icon to select. It is still, however, an ‘.img’ file. I then selected ‘Restore’ in the ‘Disk Utility’ window. This menu should restore a disk image to a disk, which is what we want. I dragged ‘iphone-dump.img’ into the ‘Source’ line and dragged whichever drive I wanted it to end up into on the ‘Destination’ line. Then I clicked the ‘Restore’ button. Unfortunately, I get ‘Restore Failure – Could not validate source. Corrupt image”.

‘Verifying’ or ‘Repairing’ the disk image also fails.

I’ve also tried mounting it using ‘Terminal’ with the commands:

hdiutil mount filename.dmg

and

hdiutil mount filename.dmg

and still nothing… just

hdiutil: mount failed - No such file or directory

I’ve also tried ‘converting’ it using the Disk Utility to a .dmg file, but this doesn’t get me any further.

I’ve tried every which way to mount the image, including using third party mounting software such as ‘Mount.app’, ‘Stuffit’ etc, and it still won’t mount!

I have transferred the disk image several times in order to rule out the possibility of a one-off transfer error.

I have found other people on a couple of forums having exactly the same problem: for example:

http://www.hackint0sh.org/forum/f127/24365.htm


Help Anyone???

Is anyone out there able to help me? Any super-techies in shining armour?

Am I overlooking something or is it simply that the disk image is corrupted?

Is there a way of comparing the disk image with the hard drive on my iPhone so I can see if anything has altered in the transfer? I’m finding it very difficult to find anything that explains how I would do it.

I’ve worked out how to ‘Checksum’ the ‘iphone-dump.img’. I did this by high-lighting the disk image, going to ‘Finder’ in the menu bar, going to ‘Services’ in the drop down menu, going to ‘Disk Utility’, and then selecting one of the two ‘Calculate Checksum’ options. I was able to view the calculated ‘Checksum’ (and it being calculated) by opening ‘Disk Utility’ and clicking on the ‘Log’ icon in the top right hand corner. I’m not yet sure which ‘Calculate Checksum’ option is relevant or what to do with the calculated ‘Checksum’ once I’ve got it.

Am I able to obtain some sort of code from the iPhone that represents it’s hard drive, therefore allowing me to compare it to a code that represents the ‘iphone-dump.img’? I think we call this a ‘Hash Value’.

If the image is corrupt, am I able to repair it manually somehow by altering the corrupt code to the correct code obtained from the iPhone?

I just don’t know!!!!! Is it more simple than I’m making out to be?

Does anyone have any ideas???

[atomic hooligan]

I found a way to sort of mount the drive and consequently do a data recovery.

What i did was highlight the 'iphone-dump.img' and opened it with 'Disk Utility'. Inside of 'Disk Utility', I double-clicked the 'iphone-dump.img' icon and low and behold, it split into two drives, despite it giving me an 'Unable to attach 'iphone-dump.img' (no mountable file systems)' message at the same time.

I wasn't able to do much with it in 'Disk Utility' from there on, so I opened 'Data Rescue II' and it became available to scan as a 'Virtual Interface' called 'Apple read:write'. I performed a scan and was able to locate my missing photos. It took a while because there were several duplicates of older photos. I think this is because each time I've restored the phone from a backup, data has been placed in a different location on the hard drive. Therefore, it has not overwritten these very same photos that have been on most of my backups for some time.

I wasn't able to find my missing voice memos from the 'QuickVoice' application though. They appear not to be there. I found the existing ones from the recovery. They must be somewhere surely? Maybe the photos are stored in a different way since the photo application is a default app and 'QuickVoice' is a bought app.

Ideas anyone?

[atomic hooligan]

wrong button, sorry

[Caramel 69]

Hey Atomic Man! you should be a super-hero! actually, you are my hero already! I've found all the information real handy as I had the same kinda problem with my phone! U know, when u said "hash value" u really got me thinking, how about a coffee and some "hash cakes" instead?

Caramel

[atomic hooligan]

Cheers Caramel!

Coffee and hash cakes sound great! I'm really glad you found the guide useful. I worked really hard on it. It was therapy to ease my fury! I wanted to get my own back on Apple and start a mutiny! I've since calmed down. Nevertheless, I'm thinking of starting a website called 'applearepissingmeoff.com'. The iPhone, as beautiful as it is, needs to be a little more forgiving when it comes to the accidental loss of data.

Enjoy those cakes! I know I will!

Atomic Hooligan

[ThereIsNoBall]

Thanks AH!

You're guide helped me avert some serious disaster. I restored the GF's phone before she backed up her photos.

I would have totally been in the doghouse, but I think I recovered most of the lost pics using your method!

Sorry you haven't gotten all that you needed, but it was just the thing for my situation!

Thanks!
TiNB

[markess1234]

itune wont read my iphone

[pinnpeak]

Atomic Hooligan -

I have succesfully done all of the steps up until the disk dump. Every time I put in the command dd if=/dev/disk0 | ssh [email protected]’sIPaddress ‘dd of=iphone-dump.img’ I get the following result:

dd: reading `/dev/disk0': Invalid argument
0+0 records in
0+0 records out
0 bytes (0 B) copied, 0.000587 s, 0.0 kB/s

This puts the dump file onto my computer but at ZERO KB. It never changes. I changed /disk0 to /zero and it began to dump to the hard drive but it continues to upload the DMG file until well passed the size of my iphone. I have a 32GB and the last one it was still going at 47GB.

Please advise you if you have seen this dilemma. Thanks!

[miscreanity]

Pinn (resisting temptation to call you PP) -

Which phone do you have: 3G, 3GS? Also, which firmware: 3.0/7A341, 3.0.1/7A400? Are you using a Linux, Mac, or Windows system?

/dev/zero is kind of the opposite of /dev/null - the latter is a black hole, and the former is staring into the sun. All you'll get when reading /dev/zero is... zeroes! Therefore, if you keep reading from it, you keep getting zeroes.

[iJulien]

Hi everyone

First, thanks for putting this tutorial together, I've been looking for an answer for days!
Went to te Maldives two weeks ago, took 300 shots and even underwater video with my iPhone 3gS!!!!
Lost everything because of a buggy app.
I have the same problem as cited above, no dump made, 0 byte...
iPhone 3GS with 3.0.1 firmware
ssh on osx leopard with latest mb pro.
Owww Gowd please help...

[iJulien]

Here's what I get in the terminal of my 3GS
Any ideas about how to move further?
I've tried 2 methods with dd and dd/nc

Last login: Tue Aug 18 23:52:16 on ttys000
OSX-JULIEN:~ Ju$ ssh [email protected]
[email protected]'s password:
Blueberry:~ root# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/disk0s1 750M 536M 208M 73% /
devfs 27K 27K 0 100% /dev
/dev/disk0s2s1 30G 17G 13G 58% /private/var
Blueberry:~ root# mount
/dev/disk0s1 on / (hfs, local, noatime)
devfs on /dev (devfs, local)
/dev/disk0s2s1 on /private/var (hfs, local, noatime)
Blueberry:~ root# /bin/dd if=/dev/disk0s2s1 bs=4096 | nc 192.168.2.4 7000
/bin/dd: opening `/dev/disk0s2s1': Resource busy
Blueberry:~ root# /bin/dd bs=4096 if=/dev/disk0s2s1 | ssh [email protected] 'dd of=iphone-dumpz.img'
/bin/dd: opening `/dev/disk0s2s1': Resource busy
Password:
0+0 records in
0+0 records out
0 bytes transferred in 0.000034 secs (0 bytes/sec)
Blueberry:~ root#

What about compiling this command line tool on the iPhone and then execute via ssh?
PhotoRec - CGSecurity

[pinnpeak]

You can call me PP all you want Miscreanity!

I have an iphone 3GS running 3.0.1 and I am on a macbook pro (the newest one). I have still not been able to resolve the issue. Thanks in advance if you have any suggestions.

Pinn (resisting temptation to call you PP) -

Which phone do you have: 3G, 3GS? Also, which firmware: 3.0/7A341, 3.0.1/7A400? Are you using a Linux, Mac, or Windows system?

/dev/zero is kind of the opposite of /dev/null - the latter is a black hole, and the former is staring into the sun. All you'll get when reading /dev/zero is... zeroes! Therefore, if you keep reading from it, you keep getting zeroes.

[maggiemae]

I found this post when searching in great frustration and a bit of desperation- I accidentally deleted an important voice memo yesterday from my ipod touch, didn't even realize I had touched the delete button until the little wheel was spinning and it was dissolving before my eyes I'm a long-time mac user, but new to the "touch" (couple months ago, have the 3.0 version, 32G). I recall some years ago hearing about doing things under "terminal" but I'm not well versed in this area, and don't know if it would even work for the touch. This post makes me hopeful, but it's also daunting- I'm afraid I'd screw up my ipod in trying to do it- so, my questions: 1) can this process work on the touch? 2) could it work to retrieve voice memos? 3) what is the risk of my messing up and losing other stuff in this altered mode? Has anyone else actually had success recovering deleted files on the touch? (not just mp3s)- thanks so much for any insight you might share- seems like some knowledgeable people here.

[miscreanity]

PP - lol, that's kind of creepy. Hey, that rhymed! Anyway, your problem seems like what iJulien, maggie and I are experiencing. Of course, we all have the 3GS. Can you see a common theme here? Talk about aggravating.

A discussion more oriented toward this problem on the 3GS is here:
How to Jailbreak iPhone Firmware 3.0 - PwnageTool

maggiemae - 1) probably; 2) most likely, so long as the voice note hasn't been overwritten already; 3) high, especially not being familiar with terminal operations.

There are a number of utilities that you could try using. There are also services available, but they may be too expensive for a voice note. Most of what I've found has been iPhone related, but a lot of it should work on the iPod as well.

[maggiemae]

Hi- thx for reply. I thought I'd update folks - after ~7 hours of hunting around on the web for computer geniuses ;-) I found a site that described something that looked like it could work..... Using SFTP in OS X with iPhone - ModMyi - Wiki -check it out if you want. I was so surprised and relieved to be able to go in under the ipod's root folder and dig it out- it was in some folder in a folder in a folder called recordings, and there it was! Only thing that was odd, but not a big deal, is it's in a quicktime movie format, which it normally isn't- not sure why, but I have it and can play it and that's the most important thing. I imagine somewhere there is instruction as to how to convert that file to an mp3 or something, but it's not as pressing right now.

[pinnpeak]

I see. So basically nobody has a solution as to how to dump the iphone's hard drive onto the desktop so as to recover it using data rescue, et al. The discussion link you sent has nothing to do with my issue. I am trying to recover all of the files off of the iphone that were erased and the back-up never made. I appreciate your help but was really just hoping the terminal codes we were using were off somewhat and there was an easy solution in the dd command that might actually get a dump to occur.

Thanks again and good luck. If anyone else has solved this riddle, please post.

PP - lol, that's kind of creepy. Hey, that rhymed! Anyway, your problem seems like what iJulien, maggie and I are experiencing. Of course, we all have the 3GS. Can you see a common theme here? Talk about aggravating.

A discussion more oriented toward this problem on the 3GS is here:
How to Jailbreak iPhone Firmware 3.0 - PwnageTool

maggiemae - 1) probably; 2) most likely, so long as the voice note hasn't been overwritten already; 3) high, especially not being familiar with terminal operations.

There are a number of utilities that you could try using. There are also services available, but they may be too expensive for a voice note. Most of what I've found has been iPhone related, but a lot of it should work on the iPod as well.

[eng]

Is it the same way for Windows users?

[cyclonefr]

Just wanted to post I managed to finally dump my /private/var partition from my 3GS : the culprit is the dd command you need to type and isn't the correct one :

the correct one is :

ssh [email protected] dd if=/dev/disk0 bs=1M | dd of=iphone.img

so just add bs=1M and it should work.. It did for me !

Enjoy !

P.S: if you only wanna backup the private/var partition, specify rdisk0s2s1

[pinnpeak]

I don't understand how this worked? You are not telling the iphone to dump anywhere. How does that line of code know to dump to the computer? Are you doing this command from the iphone or from the computer's terminal? Can you clarify?

Just wanted to post I managed to finally dump my /private/var partition from my 3GS : the culprit is the dd command you need to type and isn't the correct one :

the correct one is :

ssh [email protected] dd if=/dev/disk0 bs=1M | dd of=iphone.img

so just add bs=1M and it should work.. It did for me !

Enjoy !

P.S: if you only wanna backup the private/var partition, specify rdisk0s2s1

[miscreanity]

PP - I have no idea why I posted an unrelated link last time. I meant to send you to this thread.

The way cyclonefr is doing this is from the computer side, but /dev/disk0 in the example should be /dev/rdisk0.

What's happening is:
1 - "ssh [email protected]"
ssh client on computer connects to ssh server on iphone ->

2 - "dd if=/dev/rdisk0"
which allows executing dd command on iphone ->

3 - "|"
the pipe shunts data to terminal output on local machine ->

4 - "dd of=iphone-dump.img"
and the local dd command acts on the local system to write the data to a local file


Again, thank you very much cyclonefr!