How to recover deleted images from any iOS device

Every digital forensics examiner knows that images stored in a mobile device’s memory could contain case related information. Unfortunatelly, during lots of digital forensic examinations we see that such images are usually deleted by device’s users. If we are talking about traditional computer forensics, the solution is quite straightforward – we image the hard drive and then use our favorite data recovery utilities or corresponding modules of forensic suites. Of course, there are issues even here, especially when we are talking about SSDs.

But what about mobile devices and especially iOS devices? Recovering deleted data from such devices is extremely challenging. There is still no way to jailbreak an iOS device running version 9.2, so it’s not possible to perform a physical extraction.

Using logical extraction methods, we can recover deleted SQLite database records. But what about images?

Hopefully, there is a way to recover deleted images from iOS devices. The solution is – iThmb files.

In an iTunes backup, these files are stored under CameraRollDomain\Media\PhotoData\Thumbnails (fig. 1).

 

iOS_forensic_data_recovery

Figure 1. The .ithmb files located under CameraRollDomain\Media\PhotoData\Thumbnails

These files contain thumbnails for all images including the deleted ones. So, we have found the place, where the deleted iOS images are stored, but there is another question. How can we extract them?

And again there is a solution. To export found deleted images, a digital forensics examiner can use iThmb Converter (fig. 2).

weare4n6_ios_forensics_deleted_image_recovery

Figure 2. An iThmb file opened in iThmb Converter

This tool is quite easy to use: just export iThmb files from your iTunes backup (of course, you can use any available type of data extraction) and open containing folder in iThmb Converter. Then just choose the images you need and export them to the folder you like.

You can download iThmb Converter here.

 

About the author:

Oleg Skulkin

Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics

  1. Hi,

    Do you have any idea how long old thumbnails are kept? For example can you recover thumbnails for ALL deleted photos or are the old thumbnails eventually deleted?

    Cheers

  2. Hi, I had deleted couple of images from my iMac drive due to drive space full. when i need those images Then I used stellar photo recovery software for recovery, It recover all my drive picture with simple steps. Thanks!

  3. Hello,

    My iPhone X was stuck on loop logo, and I think this happened because it was too full.
    I tried to Update the ios through iTunes, but then it switched to restoration (without any specific warning, I just saw the term restoring during the process). I panicked because I had heard a restore deletes everything, so I stopped the process halfway through. Now the phone is dead as a brick. The issue is I had a ton of photos and videos from a year before that I was waiting to transfer once I got a new computer.

    I have read on Apple websites, etc., that there is nothing to do for me. That all data has been erased already (which I didn’t think was a possible thing through restoring an OS on an otherwise functioning device, I admit I was completely ignorant of that fact).

    I am looking around to know if there is any way that the data can actually be retrieved from a “dead” device like mine. Like bypassing whatever restoration was in process and just transfer the images and videos in any format whatsoever. This is mostly all I want, it’s more important to me than the device itself. Even if I’m having to learn an important lesson, I hope something can be done. I am getting a new device soon as I don’t want to mess with the frozen one.

Leave a Reply

Your email address will not be published. Required fields are marked *