iPad data recovery after full reset?

Discussion in 'All Things Apple' started by DLeRium, Jan 9, 2013.

Thread Status:
Not open for further replies.
  1. DLeRium

    DLeRium Lifer

    Joined:
    Feb 19, 2001
    Messages:
    20,098
    Likes Received:
    1
    Say I lost all backups on my computer. Is it technically possible to pull data off an iPad?

    This is more of a debate between me and my buddy who's an Apple employee. And because he's an Apple Employee, people seem to take him more seriously.

    He's basically saying because its NAND and you wipe the partition on a full reset, your data is toast. He tells me it doesn't matter if you write 0s or not across the partition and that NAND data is irrecoverable.

    However, I'm looking at it from a data recovery perspective. When you wipe a partition, your data isn't gone yet. It's not gone til you write 0s across the whole partition. Correct me if I'm wrong.

    I explained that data should still be there unless you write 0s, and so you can try data recovery, although there's probably some writing in the reset process that will bork your data. However, unless you write across the entire partition, you can still have chunks remaining. Given a picture is only a few mb, you can hope that a few are still intact?

    Basically I'd like to confirm that the resetting of the iPad itself doesn't actually wipe the data. It's the action of a reset that causes some data writes that can cause significant degradation to data that was previously there, thus reducing your chances of a clean recovery that makes the situation difficult?

    Am I right or is he right?
     
  2. MotionMan

    MotionMan Lifer

    Joined:
    Jan 11, 2006
    Messages:
    17,208
    Likes Received:
    0
    Your first question (bolded) does not seem related to the rest of your post, so I am a little confused.

    Your backups lost from a computer and you trying to pull data from the iPad to a computer to recreate the backups? Or are you just talking about recovering data from an erased iPad (without any backups)?

    MotionMan
     
  3. SKORPI0

    SKORPI0 Lifer

    Joined:
    Jan 18, 2000
    Messages:
    13,815
    Likes Received:
    12
  4. ChAoTiCpInOy

    ChAoTiCpInOy Diamond Member

    Joined:
    Jun 24, 2006
    Messages:
    6,442
    Likes Received:
    0
    Aren't iOS devices now "encrypted" in some manner. Doesn't that mean without the key its all just jumbled up anyways?
     
  5. Oyeve

    Oyeve Lifer

    Joined:
    Oct 18, 1999
    Messages:
    19,004
    Likes Received:
    8
    You are correct. Data will be there, nand or not. Even writing 0s across the mem will always leave some data. There is really no way to completely wipe data except by destroying.
     
  6. TheStu

    TheStu Moderator<br>Mobile Devices & Gadgets
    Moderator

    Joined:
    Sep 15, 2004
    Messages:
    11,781
    Likes Received:
    1
    So, you're saying that nuking it from orbit is the only way to be sure?

    I thought that a 7 pass zero-ing was the gold standard. Or has data recovery tech improved?
     
  7. Oyeve

    Oyeve Lifer

    Joined:
    Oct 18, 1999
    Messages:
    19,004
    Likes Received:
    8
    It has improved vastly. Although zeroing out the memory for 365 days may render it "wiped" as long as the nand is funtional there will always be some residual data. Destroying is basically the only way to be sure. There are labs than can piece back data from shattered glass platters now. Laser restore is the wave of the future.
     
  8. TheStu

    TheStu Moderator<br>Mobile Devices & Gadgets
    Moderator

    Joined:
    Sep 15, 2004
    Messages:
    11,781
    Likes Received:
    1
    Dang.
     
  9. ViRGE

    ViRGE Elite Member, Moderator Emeritus

    Joined:
    Oct 9, 1999
    Messages:
    31,078
    Likes Received:
    8
    This is the correct answer. iPads, like most modern SSDs, use what amounts to always-on encryption. The device's storage is written/read from against an AES key, meaning that all data is always encrypted. Wiping the device in turn is achieved by purging the key (SSDs call this a Secure Erase), at which point what's left is a bunch of useless data that cannot be decrypted. Technically your data is still there, however recovering it would require knowing which one of the 2^128 (3.4 x 10^38) keys decrypts it. As a result it is unrecoverable and effectively reduced to random data.

    Actually "wiping" NAND storage is a poor strategy, which is why the key method is used. The wear a wipe puts on the NAND is undesirable given the limited number of writes NAND can endure, and it interferes with NAND lifecycle management techniques like wear leveling.
     
    #9 ViRGE, Jan 10, 2013
    Last edited: Jan 10, 2013
Thread Status:
Not open for further replies.