1. ericjones's Avatar
    thanks for the guide.

    i'm using MAC OSX 10.6 and iPhone 3GS 3.1.

    here's a few things that helped me:

    1. my disk was rdisk0s2s1 so I typed in "dd if=/dev/rdisk0s2s1 bs=4096KB | ssh [email protected] 'dd of=iphone_rdisk0s2s1_4096KB.img'
    2. i didn't understand that I had to perform the operation as root#. So I kept getting error, Permission Denied. To get to root#, in Terminal on your iPhone, enter "login", then enter "root", then enter the password ("alpine").
    3. cApS matter. i spun my wheels for a while because I didn't capitalize the username of my Mac.
    4. i ended up using "~4096KB"

    this took way too long to figure out, but it's cranking away as we speak. epic!

    hope this helps.
    2010-10-16 02:54 PM
  2. gloria80's Avatar
    so, I enter the commands in terminal and it begins to transfer. But then after a few hours (anywhere from 1-4) it stops and gives me a "Read from remote host (iphone ip address): Operation timed out" message. Any ideas how to keep the connection running longer?


    got it to work by running "ping (iphone ip address)" in a separate terminal window while I was copying the disk image. took forever though, like 17 hrs!
    Last edited by gloria80; 2010-10-19 at 06:52 PM.
    2010-10-17 04:33 PM
  3. Juniad Khan's Avatar
    Hi all

    Thank you so much guys for such an amazing guide to follow.
    I wanted to recover some lost photos and videos after an accidental restoration of my iPhone. I think I could manage to make the disk image as described.
    Problem is, once in Photorec and after recovering I get no recovered file and also this message (note the error at the end):

    PHP Code:
    PhotoRec 6.11.3Data Recovery UtilityMay 2009                                
    Christophe GRENIER 
    Disk iphone_rdisk0s2_4096.img 15 GB 14 GiB (RO)                             
    Partition                  Start        End    Size in sectors             
       P HFSX                     0   0  1  1828 254 63   29382885                  
    0 files saved in 
    /Users/juni/Downloads/recovery/recup_dir directory.            
    Recovery completed.                                                             
    Error reading sector   29370368 
    I really am a noob on such matter and actually don't understand s*** to it. If anybody could confirm there's not much to hope or on a delightfull contrary give a hand, opinion or anykind of help I would in any case be grateful.

    Note that I've also tried selecting all the file types in photorec and didn't get this previous message at all.
    By the way, photorec managed to recover a weird 3GB .mpg file wich dosen't match with anything and none of my players could open (of course).

    So... Dunno... Anyone ? Thanks again!
    2010-11-28 02:38 PM
  4. Juniad Khan's Avatar
    2010-11-30 06:09 PM
  5. Runnybunny's Avatar
    I lost some carrier files, but I know which ones and where they come from. If I can get my hands on those files, will it work to just copy them into the directory where they are supposed to be?
    2010-12-01 08:31 AM
  6. Estefan's Avatar
    my iPhone 3Gs is 32G
    I take the image of user partition in linux , and I mount the image in linux with "mount iphone-user.img /mnt/iphone -o loop"

    now I can see the file system directory and files, also size of files is correct too, but when I copy a file with cp command to my computer and compare it with a file that I copied before directly from my iPhone they are completely different (in content).

    any idea why?
    is it something related to encrypted file system in 3Gs?
    2010-12-01 01:41 PM
  7. saintx7's Avatar
    i'm using iphone 4 os 4.1
    i already tried anything
    for transfering img file to

    dd if=/dev/rdisk0s2 bs=4096 | ssh [email protected] 'dd of=iphone_rdisk0s2_4096.img'


    dd if=/dev/rdisk0s2 bs=4096KB | ssh [email protected] 'dd of=iphone_rdisk0s2_4096KB.img'


    dd if=/dev/rdisk0s2s1 bs=4096KB | ssh [email protected] 'dd of=iphone_rdisk0s2s1_4096KB.img'


    dd if=/dev/disk0 | ssh <username>@<computer-ip> 'dd of=iphone-dump.img'

    but when i input the password
    always got "setgid : invalid argument"

    anyone can help me please???
    2010-12-12 05:45 PM
  8. mmpirrottina's Avatar
    Hi guys,
    I have been following every step to the letter and it is still not working for me. It keep getting the same result as abrasBR and spets. Any suggestions as to what may need to be done to get it working?
    Also, would anyone be able to tell me, what is supposed to temporarily freeze, the terminal on the mac or the mobile terminal?
    Thanks, really need this to work.
    2011-01-30 02:12 PM
  9. lma2000's Avatar
    Got the same as most people. Loaded up the image using testdisk and photorec but no cigar. Against my own good judgement I even took a photo and deleted it to see if I can recover it. Nada! Am I missing something?
    2011-02-08 05:21 PM
  10. redribbon's Avatar
    hello can someone here tell me the name of "search content" program?coz it seems like the file has been removed from the link.thank u.

    ps.maybe also help me with link that still work?thank u so much.
    2011-02-17 08:52 AM
  11. ShiBBan's Avatar
    Thanks for this, but I have a problem!

    When I type in the command "umount -f /private/var" in the terminal, nothing happens. Everything goes fine untill then.. So I tried with not put in this command in the terminal (or either the "mount -o ro /private/var") and just went for the last command (dd if=/dev/rdisk0s2 bs=4096 | ssh [email protected] 'dd of=iphone_rdisk0s2_4096.img'). When I did this the img was stared, but when it was done it was only 15,04gb and when I searched the file with PhotoRec nothing came up. Not one singel file! I have not restored my phone with iTunes or anything like that.

    Do you guys know what to do?

    Im using iPhone 4 16gb, FW 4.01 and OS X 10.6.6

    (Im from Sweden so sorry if my english suck )
    2011-02-28 04:44 PM
  12. Griso's Avatar
    With iOS 4 you can't restore files from a disk dump of the user partition, due to the fact, that Apple introduced a new security feature "data protection".

    Search for "MobileKeyBag" if you need more information.

    2011-03-01 08:27 AM
  13. ShiBBan's Avatar
    Okey, so their is no way then? (downgrade?)
    2011-03-01 11:45 AM
  14. Griso's Avatar
    not for deleted files as far as I know.
    2011-03-01 11:50 AM
  15. ShiBBan's Avatar
    Okeeey ! Is there a way to do something with iMovie or iPhoto? I had some videos and pictures that I have accidently deleted, did a try to get them back with Datarescue 3 on my computer, but no luck..
    2011-03-08 11:06 AM
  16. neenja's Avatar
    does anyone know if its possible or any kind of hack solution to recover files from an iphone4 4.2.1?
    2011-03-08 11:17 PM
  17. ShiBBan's Avatar
    Yeees please! I say the same thing (but FW 4.01 )
    2011-03-09 12:09 PM
  18. rodrigoplant's Avatar
    Damn iOS 4.3 (iPhone 4) released before schedule! Back from a 5-day festival and did update BEFORE the backup. Restored to JBcked 4.2.1 and got the .img file, but there's no way to restore something with PhotoRec (6.12 Windows 7 x64). Mounted the .img with a lot of emulators and tried to restore with undelete softwares ─ but nothing as well. Any clue? This is so ******* sad. Thanks.
    Last edited by rodrigoplant; 2011-03-11 at 03:27 AM.
    2011-03-11 02:56 AM
  19. iPants's Avatar
    Really helpful information in this thread, but I too hope us 4.0+ folks aren't out of luck.

    I hope I can post about this: there is software called Lantern that will probably accomplish this, but it looks like it's only available to law enforcement, and it's likely very expensive.
    2011-03-11 10:53 PM
  20. ShiBBan's Avatar
    Tell me how to get my missing files back, I don't care if it's against the law haha!
    2011-03-13 11:47 PM
73 1234