iPad data recovery after full reset?

[DLeRium]

Say I lost all backups on my computer. Is it technically possible to pull data off an iPad?

This is more of a debate between me and my buddy who's an Apple employee. And because he's an Apple Employee, people seem to take him more seriously.

He's basically saying because its NAND and you wipe the partition on a full reset, your data is toast. He tells me it doesn't matter if you write 0s or not across the partition and that NAND data is irrecoverable.

However, I'm looking at it from a data recovery perspective. When you wipe a partition, your data isn't gone yet. It's not gone til you write 0s across the whole partition. Correct me if I'm wrong.

I explained that data should still be there unless you write 0s, and so you can try data recovery, although there's probably some writing in the reset process that will bork your data. However, unless you write across the entire partition, you can still have chunks remaining. Given a picture is only a few mb, you can hope that a few are still intact?

Basically I'd like to confirm that the resetting of the iPad itself doesn't actually wipe the data. It's the action of a reset that causes some data writes that can cause significant degradation to data that was previously there, thus reducing your chances of a clean recovery that makes the situation difficult?

Am I right or is he right?

[MotionMan]

Originally Posted by DLeRium

Say I lost all backups on my computer. Is it technically possible to pull data off an iPad?

This is more of a debate between me and my buddy who's an Apple employee. And because he's an Apple Employee, people seem to take him more seriously.

He's basically saying because its NAND and you wipe the partition on a full reset, your data is toast. He tells me it doesn't matter if you write 0s or not across the partition and that NAND data is irrecoverable.

However, I'm looking at it from a data recovery perspective. When you wipe a partition, your data isn't gone yet. It's not gone til you write 0s across the whole partition. Correct me if I'm wrong.

I explained that data should still be there unless you write 0s, and so you can try data recovery, although there's probably some writing in the reset process that will bork your data. However, unless you write across the entire partition, you can still have chunks remaining. Given a picture is only a few mb, you can hope that a few are still intact?

Basically I'd like to confirm that the resetting of the iPad itself doesn't actually wipe the data. It's the action of a reset that causes some data writes that can cause significant degradation to data that was previously there, thus reducing your chances of a clean recovery that makes the situation difficult?

Am I right or is he right?

Your first question (bolded) does not seem related to the rest of your post, so I am a little confused.

Your backups lost from a computer and you trying to pull data from the iPad to a computer to recreate the backups? Or are you just talking about recovering data from an erased iPad (without any backups)?

MotionMan

[SKORPI0]

Perhaps this way?

can i recover deleted files on ipad?

[ChAoTiCpInOy]

Aren't iOS devices now "encrypted" in some manner. Doesn't that mean without the key its all just jumbled up anyways?

[Oyeve]

You are correct. Data will be there, nand or not. Even writing 0s across the mem will always leave some data. There is really no way to completely wipe data except by destroying.

[TheStu]

Originally Posted by Oyeve

You are correct. Data will be there, nand or not. Even writing 0s across the mem will always leave some data. There is really no way to completely wipe data except by destroying.

So, you're saying that nuking it from orbit is the only way to be sure?

I thought that a 7 pass zero-ing was the gold standard. Or has data recovery tech improved?

[Oyeve]

Originally Posted by TheStu

So, you're saying that nuking it from orbit is the only way to be sure?

I thought that a 7 pass zero-ing was the gold standard. Or has data recovery tech improved?

It has improved vastly. Although zeroing out the memory for 365 days may render it "wiped" as long as the nand is funtional there will always be some residual data. Destroying is basically the only way to be sure. There are labs than can piece back data from shattered glass platters now. Laser restore is the wave of the future.

[TheStu]

Originally Posted by Oyeve

It has improved vastly. Although zeroing out the memory for 365 days may render it "wiped" as long as the nand is funtional there will always be some residual data. Destroying is basically the only way to be sure. There are labs than can piece back data from shattered glass platters now. Laser restore is the wave of the future.

Dang.

[ViRGE]

Originally Posted by ChAoTiCpInOy

Aren't iOS devices now "encrypted" in some manner. Doesn't that mean without the key its all just jumbled up anyways?

This is the correct answer. iPads, like most modern SSDs, use what amounts to always-on encryption. The device's storage is written/read from against an AES key, meaning that all data is always encrypted. Wiping the device in turn is achieved by purging the key (SSDs call this a Secure Erase), at which point what's left is a bunch of useless data that cannot be decrypted. Technically your data is still there, however recovering it would require knowing which one of the 2^128 (3.4 x 10^38) keys decrypts it. As a result it is unrecoverable and effectively reduced to random data.

Actually "wiping" NAND storage is a poor strategy, which is why the key method is used. The wear a wipe puts on the NAND is undesirable given the limited number of writes NAND can endure, and it interferes with NAND lifecycle management techniques like wear leveling.