Data Acquisition from iOS Devices - Practical Mobile Forensics - page 106

key835: ef8f36fb3a85b42a72e8c5efa6b1a844
key89B: de75b5f5fa6abc5bf25293b38f980a52
[...]
cprotect version : 4 (iOS 5)
iOS version: 5.1.1
(iPhone4-data) / undelete
Building FTL lookup table v1
100% |###################################|
Collecting existing file ids
23297 file IDs
Carving catalog file
Found deleted file record 51657 shaders.data created
2012-06-09 02:19:28
Found deleted file record 51656 shaders.maps created
2012-06-09 02:19:28
[...]
Carving attribute file for file keys
20261 files, 50997 keys
_FBStory.h
[...]
The command recovers the deleted files and places them into a directory named unde-
lete . The recovery process is slow and takes hours to recover all the files.
If a device is restored, wiped, or upgraded to a new OS version, the file system key (EMF)
is erased and a new key is recreated. Without the original EMF key, it is not possible to re-
cover the underlying file system structure. So, it is not possible to recover the deleted files
when an iPhone is restored, wiped, or upgraded. Also, iOS devices include a feature
called Effaceable Storage to securely erase the keys. This feature accesses the underlying
storage (NAND) to directly address and erase a small number of blocks at a very low
level, which makes it impossible to recover deleted keys.