search

R1NZLR / iphone-dataprotection

Automatically exported from code.google.com/p/iphone-dataprotection
0 stars 1 forks source link

ios_examiner.py - undelete command returns 0 recovered files #68

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
Running the following command post NAND and keybag unlock:

python python_scripts/ios_examiner.py new_nand.bin new.plist

Within the ios_examiner running the undelete command results in the following:

Carving attribute file for file keys
611 files, 1186 keys
No file key for localtime
localtime
1 versions for first lba
com.apple.commcenter.plist.Tc5kvUQ
800 versions for first lba
...
temp8003
800 versions for first lba
cydia.log
800 versions for first lba
KeywordIndex.plist
2 versions for first lba
com.apple.Preferences.plist.ccNlsmh
800 versions for first lba
temp8339
4 versions for first lba
No file key for sh-thd-1342632981
sh-thd-1342632981
800 versions for first lba
com.apple.AppSupport.plist
2 versions for first lba
Carving done, recovered 0 deleted files, 0 are most likely OK
(iPhone-data) / 

Using the most recent tools available via the repositories/hubs on a dedicated 
Macbook running OSX 10.7.4

The above stated console output was gathered via a NAND dump in which files 
were written to and deleted from the file system. Similar results were achieved 
on a NAND dump in which I had not manually created and deleted files.

Thank you.

Original issue reported on code.google.com by oakridge...@yahoo.ca on 8 Aug 2012 at 4:26

GoogleCodeExporter commented 8 years ago 
This issue was updated by revision 3bd0f8f80b8f.

Original comment by jean.sig...@gmail.com on 10 Aug 2012 at 2:27

GoogleCodeExporter commented 8 years ago 
I just pushed a fix that should fix this (assuming the target device runs iOS 
4).

Original comment by jean.sig...@gmail.com on 10 Aug 2012 at 2:29

GoogleCodeExporter commented 8 years ago 
The supplied modifications/fix to the code appear to have resolved the issue, I 
have been able to successfully recover items utilizing the ios_examiner.py 
script:

[937127, 937128, 937129, 937140, 937153]
Recovered 9582:com.apple.AppSupport.plist 0 missing pages, size 71bytes, 
created 2012-07-18 06:12:51, contentModDate 2012-07-18 06:12:51
Carving done, recovered 99 deleted files, 91 are most likely OK
(iPhone-data) / 

Thank you.

Original comment by oakridge...@yahoo.ca on 11 Aug 2012 at 7:13

GoogleCodeExporter commented 8 years ago

Original comment by jean.sig...@gmail.com on 16 Feb 2013 at 3:55