There are various methods for iPhone users to recover deleted data. In this article, we look at those methods.
In the iOS operating system, unless you have a backup locally or in the cloud, you are unlikely to recover any data. However, even if you do not have a backup, there are some methods that allow you to recover your data. iPhone users have the chance to recover the types of data that we will talk about below if certain conditions are met.
1. Deleted Records from SQLite Databases
Apple stores many types of user data in SQLite format in various databases . a user; When he deletes any record from the Messages app, such as an iMessage , a Safari bookmark, or a history item, that record is not immediately deleted in the SQLite database for performance considerations. Instead, the SQLite engine marks the record as “deleted”, marks the page as unused, and adds a reference to the “free list”. Such deleted records may be stored in SQLite “free lists” for a period of time, allowing data recovery tools to attempt to recover the data.
Any method of recovering data from an SQLite database will only work if:
- You should have been able to extract the infected SQLite database with a low-level extraction tool. (For this, you need to jailbreak your device or use Elcomsoft iOS Forensic Toolkit .)
- The database itself must not have been cleaned or defragmented. Because when either of these two situations occurs, the deletion process becomes permanent.
- You have to be fast enough and remove the infected database within seconds after the record is deleted. Because since iOS 12 , the system permanently deletes recordings immediately after deletion. For this reason, we have to say that it is not possible to recover deleted SQLite records in iOS 12 and newer versions.
Long story short, the method of recovering data from SQLite is no longer applicable to deleted iMessages, Safari bookmarks, tabs, and history or other types of data stored in SQLite databases.
2. Data Inside WAL Files
As we mentioned above, even the latest versions of iOS quickly clean SQLite databases, preventing the recovery of deleted records (messages, call logs or contacts). However, SQLite databases have another feature that will allow you to recover your data. SQLite keeps new records in WAL files . If such unmerged records are deleted, they are retained in their respective WAL files until they are merged with the master database. This means that some records that have been deleted and not merged can be recovered.
Any method of recovering data stored in WAL files will only work if:
- You must have low-level access to the file system. (For this, you need to jailbreak your device or use Elcomsoft iOS Forensic Toolkit.)
- WAL files should still not be merged.
- You must not have created an iTunes backup between the time the recording was deleted and the time of extraction . Because as soon as you start creating an iTunes backup, WAL files are merged with their respective master databases and deleted records are lost. However, media files are the exception in this regard. When extracting media files (from any device, including iPhone, iPad, Apple Watch, and Apple TV models) via the iOS Forensic Toolkit, you also get uncombined WAL files. This allows some image metadata to be recovered.
3. Data Retained in Legacy Local Backups
If you have a local backup, the main issue here is how to access the data without restoring the entire backup on some iOS device. There are numerous tools on the market, including the Elcomsoft Phone Viewer , that allow to parse the contents of local backups, view or extract individual files and database records (for example, messages or log entries).
However, keep in mind that you can access more information if your iTunes backup is password protected. While it is too late to set a password for data recovery purposes, it is very important that you set a strong backup password for security purposes.
4. Data Found in Old iCloud Backups
This data recovery method is also similar to the previous one but not exactly the same. If you have cloud backups, you may have old copies of your data that you can download with Elcomsoft Phone Breaker and analyze with Elcomsoft Phone Viewer. Specifically, Apple keeps your last two iCloud backups (there used to be three), making it possible for you to download the oldest.
iCloud backup has other differences compared to local backups. For example , if you enable iCloud Photo Library , your iCloud backups do not contain photos (there is a manual override for this setting). They also don’t include any other types of synced data, depending on your sync settings and your device’s iOS version. iCloud backups also do not include any of the following:
- Keychain *
- Health data
- home data
- iCloud Photos **
- Messages **
- Since iOS 13: Call logs
- Since iOS 13: Safari history
* Actually, the keychain is included in iCloud backups, but is encrypted using a device-specific key. You won’t be able to access keychain items from iCloud backups unless you restore to the exact same device.
** Messages are not included in iCloud backups unless iCloud syncing of these categories is enabled in device settings. Photos has a manual override feature that lets you keep both synced and backup versions.
5. Synchronized Data
iPhones can sync many types of data with iCloud. However, this requires synchronization to occur in real time or very close to it. In such cases, everything you delete from your iPhone will also be deleted from the cloud, but there are of course some exceptions to this. If your iPhone is not connected to the internet between the time you delete a syncable item and the time you try to recover that data, it means that you can most likely recover that data. However, synchronization delays may occur, allowing recovery even after a period of time has elapsed.
There are also some exceptions regarding how long the data you delete is retained in iCloud. Some categories (including photos and notes, but there may be other categories) remain available in iCloud for a long time (usually about 2 or 3 weeks) after they are removed from the deleted folder. Even a few years ago, Apple kept such files indefinitely.
Why Can’t You Recover Files You Deleted From Your iPhone?
Even if you have access to the file system, you cannot free up space to search for deleted data. Because Apple has been encrypting the file system since iOS 4 , and since iOS 8 , encryption keys are based on the user’s password. So the files on the user partition (images, SQLite databases and stuff like that) are encrypted. Moreover, each file is encrypted with a separate key, which will be deleted immediately after you delete the file.
The iOS file system (Apple uses APFS across devices ; some older pre-iOS 10.3% devices use HFS+ ) includes the following features:
- Almost everything is encrypted.
- Each file is encrypted with its own unique key.
- All encryption keys are encrypted with another public key.
- This public key is calculated when users enter their passwords during initial unlock.
After any file is deleted, iOS also deletes the corresponding file key from the file’s metadata. As a result, you cannot decrypt the file without the file key, even if you read the data blocks where the deleted file was previously located.
If you return your device to its default settings (“Wipe all data” option), the “Erasable Storage” will be deleted, which will cause the public key to be destroyed. Even if the NAND storage is not wiped, this alone makes the data undecryptable and inaccessible.