Go Back   AnandTech Forums > Software > All Things Apple

Forums
· Hardware and Technology
· CPUs and Overclocking
· Motherboards
· Video Cards and Graphics
· Memory and Storage
· Power Supplies
· Cases & Cooling
· SFF, Notebooks, Pre-Built/Barebones PCs
· Networking
· Peripherals
· General Hardware
· Highly Technical
· Computer Help
· Home Theater PCs
· Consumer Electronics
· Digital and Video Cameras
· Mobile Devices & Gadgets
· Audio/Video & Home Theater
· Software
· Software for Windows
· All Things Apple
· *nix Software
· Operating Systems
· Programming
· PC Gaming
· Console Gaming
· Distributed Computing
· Security
· Social
· Off Topic
· Politics and News
· Discussion Club
· Love and Relationships
· The Garage
· Health and Fitness
· Merchandise and Shopping
· For Sale/Trade
· Hot Deals with Free Stuff/Contests
· Black Friday 2014
· Forum Issues
· Technical Forum Issues
· Personal Forum Issues
· Suggestion Box
· Moderator Resources
· Moderator Discussions
   

Closed Thread
 
Thread Tools
Old 01-09-2013, 01:57 PM   #1
DLeRium
Lifer
 
DLeRium's Avatar
 
Join Date: Feb 2001
Location: San Francisco Bay Area, CA
Posts: 19,708
Default iPad data recovery after full reset?

Say I lost all backups on my computer. Is it technically possible to pull data off an iPad?

This is more of a debate between me and my buddy who's an Apple employee. And because he's an Apple Employee, people seem to take him more seriously.

He's basically saying because its NAND and you wipe the partition on a full reset, your data is toast. He tells me it doesn't matter if you write 0s or not across the partition and that NAND data is irrecoverable.

However, I'm looking at it from a data recovery perspective. When you wipe a partition, your data isn't gone yet. It's not gone til you write 0s across the whole partition. Correct me if I'm wrong.

I explained that data should still be there unless you write 0s, and so you can try data recovery, although there's probably some writing in the reset process that will bork your data. However, unless you write across the entire partition, you can still have chunks remaining. Given a picture is only a few mb, you can hope that a few are still intact?

Basically I'd like to confirm that the resetting of the iPad itself doesn't actually wipe the data. It's the action of a reset that causes some data writes that can cause significant degradation to data that was previously there, thus reducing your chances of a clean recovery that makes the situation difficult?

Am I right or is he right?
DLeRium is offline  
Old 01-09-2013, 06:07 PM   #2
MotionMan
Lifer
 
MotionMan's Avatar
 
Join Date: Jan 2006
Location: Los Angeles, CA, USA
Posts: 16,954
Default

Quote:
Originally Posted by DLeRium View Post
Say I lost all backups on my computer. Is it technically possible to pull data off an iPad?

This is more of a debate between me and my buddy who's an Apple employee. And because he's an Apple Employee, people seem to take him more seriously.

He's basically saying because its NAND and you wipe the partition on a full reset, your data is toast. He tells me it doesn't matter if you write 0s or not across the partition and that NAND data is irrecoverable.

However, I'm looking at it from a data recovery perspective. When you wipe a partition, your data isn't gone yet. It's not gone til you write 0s across the whole partition. Correct me if I'm wrong.

I explained that data should still be there unless you write 0s, and so you can try data recovery, although there's probably some writing in the reset process that will bork your data. However, unless you write across the entire partition, you can still have chunks remaining. Given a picture is only a few mb, you can hope that a few are still intact?

Basically I'd like to confirm that the resetting of the iPad itself doesn't actually wipe the data. It's the action of a reset that causes some data writes that can cause significant degradation to data that was previously there, thus reducing your chances of a clean recovery that makes the situation difficult?

Am I right or is he right?
Your first question (bolded) does not seem related to the rest of your post, so I am a little confused.

Your backups lost from a computer and you trying to pull data from the iPad to a computer to recreate the backups? Or are you just talking about recovering data from an erased iPad (without any backups)?

MotionMan
MotionMan is offline  
Old 01-09-2013, 06:30 PM   #3
SKORPI0
Lifer
 
SKORPI0's Avatar
 
Join Date: Jan 2000
Location: I'm from the internet
Posts: 12,077
Default

Perhaps this way?

can i recover deleted files on ipad?
__________________
HP TouchPad - Dual boot Android CM10 (Jelly Bean 4.12) and webOS (F4 Phantom Kernel).
Anandtech Off Topic [Archive] - May 2000-present
i7 3930k @ 4.3GHz @ 1.28v, Asus Sabertooth X79, 32GB (4x8GB) DDR3 1866, PNY GTX 680 4GB, CM HAF 932 Advanced, CM Silent Pro Gold 1kW.
NZXT Kraken X60 PULL, Samsung 830 128gb SSD (Windows 7), Kingston
SSDNow V300 120gb (OS X 10.8.2), Dual Yamakasi 2703, Logitech MK320.
SKORPI0 is online now  
Old 01-09-2013, 10:26 PM   #4
ChAoTiCpInOy
Diamond Member
 
Join Date: Jun 2006
Posts: 6,351
Default

Aren't iOS devices now "encrypted" in some manner. Doesn't that mean without the key its all just jumbled up anyways?
ChAoTiCpInOy is offline  
Old 01-10-2013, 08:38 AM   #5
Oyeve
Lifer
 
Oyeve's Avatar
 
Join Date: Oct 1999
Location: NYC
Posts: 16,811
Default

You are correct. Data will be there, nand or not. Even writing 0s across the mem will always leave some data. There is really no way to completely wipe data except by destroying.
__________________
My Heat
Oyeve is offline  
Old 01-10-2013, 08:46 AM   #6
TheStu
Moderator
Mobile Devices & Gadgets
 
Join Date: Sep 2004
Location: New Cumberland, PA
Posts: 11,221
Default

Quote:
Originally Posted by Oyeve View Post
You are correct. Data will be there, nand or not. Even writing 0s across the mem will always leave some data. There is really no way to completely wipe data except by destroying.
So, you're saying that nuking it from orbit is the only way to be sure?

I thought that a 7 pass zero-ing was the gold standard. Or has data recovery tech improved?
__________________
Quote:
Originally Posted by mfenn View Post
The 6770M can play Crysis 2, for suitably small values of play
TheStu is offline  
Old 01-10-2013, 08:56 AM   #7
Oyeve
Lifer
 
Oyeve's Avatar
 
Join Date: Oct 1999
Location: NYC
Posts: 16,811
Default

Quote:
Originally Posted by TheStu View Post
So, you're saying that nuking it from orbit is the only way to be sure?

I thought that a 7 pass zero-ing was the gold standard. Or has data recovery tech improved?
It has improved vastly. Although zeroing out the memory for 365 days may render it "wiped" as long as the nand is funtional there will always be some residual data. Destroying is basically the only way to be sure. There are labs than can piece back data from shattered glass platters now. Laser restore is the wave of the future.
__________________
My Heat
Oyeve is offline  
Old 01-10-2013, 09:31 AM   #8
TheStu
Moderator
Mobile Devices & Gadgets
 
Join Date: Sep 2004
Location: New Cumberland, PA
Posts: 11,221
Default

Quote:
Originally Posted by Oyeve View Post
It has improved vastly. Although zeroing out the memory for 365 days may render it "wiped" as long as the nand is funtional there will always be some residual data. Destroying is basically the only way to be sure. There are labs than can piece back data from shattered glass platters now. Laser restore is the wave of the future.
Dang.
__________________
Quote:
Originally Posted by mfenn View Post
The 6770M can play Crysis 2, for suitably small values of play
TheStu is offline  
Old 01-10-2013, 10:13 AM   #9
ViRGE
Super Moderator
Elite Member
 
ViRGE's Avatar
 
Join Date: Oct 1999
Posts: 30,225
Default

Quote:
Originally Posted by ChAoTiCpInOy View Post
Aren't iOS devices now "encrypted" in some manner. Doesn't that mean without the key its all just jumbled up anyways?
This is the correct answer. iPads, like most modern SSDs, use what amounts to always-on encryption. The device's storage is written/read from against an AES key, meaning that all data is always encrypted. Wiping the device in turn is achieved by purging the key (SSDs call this a Secure Erase), at which point what's left is a bunch of useless data that cannot be decrypted. Technically your data is still there, however recovering it would require knowing which one of the 2^128 (3.4 x 10^38) keys decrypts it. As a result it is unrecoverable and effectively reduced to random data.

Actually "wiping" NAND storage is a poor strategy, which is why the key method is used. The wear a wipe puts on the NAND is undesirable given the limited number of writes NAND can endure, and it interferes with NAND lifecycle management techniques like wear leveling.
__________________
ViRGE
Team Anandtech: Assimilating a computer near you!
GameStop - An upscale specialized pawnshop that happens to sell new games on the side
Todd the Wraith: On Fruit Bowls - I hope they prove [to be] as delicious as the farmers who grew them

Last edited by ViRGE; 01-10-2013 at 10:19 AM.
ViRGE is offline  
Closed Thread

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -5. The time now is 03:49 AM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.