Making complex data simple and compelling
From digital device to digital evidence
Unlock your vehicle's digital evidence potential
Forensic Analysis and Enhancement
Investigating and analyzing financial records
Gain access to the online accounts of deceased loved ones
Clear, precise evidence for a messy world
Expert reports to suit your specific needs
We can locate people anywhere
Stop worrying and learn the truth
Prevent, Detect, Respond To Cyberattacks
First response is crucial. Every minute counts.
The first response is critical to reduce liability
Detection & Removing Spyware Services
Reduce your electronic risk from digital transmittals
Find out who you are really talking to
Experienced, Confidential Services
Swift, professional incident response
Complicated cases require compelling digital facts
Find, recover and document digital evidence
Bring solid evidence before a judge
Cases can be investigated using Social Media
Every digital forensics examiner knows that images stored in a mobile device’s memory could contain case related information. Unfortunatelly, during lots of digital forensic examinations we see that such images are usually deleted by device’s users. If we are talking about traditional computer forensics, the solution is quite straightforward – we image the hard drive and then use our favorite data recovery utilities or corresponding modules of forensic suites. Of course, there are issues even here, especially when we are talking about SSDs.
But what about mobile devices and especially iOS devices? Recovering deleted data from such devices is extremely challenging. There is still no way to jailbreak an iOS device running version 9.2, so it’s not possible to perform a physical extraction.
Using logical extraction methods, we can recover deleted SQLite database records. But what about images?
Hopefully, there is a way to recover deleted images from iOS devices. The solution is – iThmb files.
In an iTunes backup, these files are stored under CameraRollDomain\Media\PhotoData\Thumbnails (fig. 1).
Figure 1. The .ithmb files located under CameraRollDomain\Media\PhotoData\Thumbnails
These files contain thumbnails for all images including the deleted ones. So, we have found the place, where the deleted iOS images are stored, but there is another question. How can we extract them?
And again there is a solution. To export found deleted images, a digital forensics examiner can use iThmb Converter (fig. 2).
Figure 2. An iThmb file opened in iThmb Converter
This tool is quite easy to use: just export iThmb files from your iTunes backup (of course, you can use any available type of data extraction) and open containing folder in iThmb Converter. Then just choose the images you need and export them to the folder you like.
You can download iThmb Converter here.
About the author:
Oleg Skulkin
Interests: iOS forensics, Android forensics, Mac OS X forensics, Windows forensics, Linux forensics
Hi,
Do you have any idea how long old thumbnails are kept? For example can you recover thumbnails for ALL deleted photos or are the old thumbnails eventually deleted?
Cheers
Hi, I had deleted couple of images from my iMac drive due to drive space full. when i need those images Then I used stellar photo recovery software for recovery, It recover all my drive picture with simple steps. Thanks!
Hello,
My iPhone X was stuck on loop logo, and I think this happened because it was too full. I tried to Update the ios through iTunes, but then it switched to restoration (without any specific warning, I just saw the term restoring during the process). I panicked because I had heard a restore deletes everything, so I stopped the process halfway through. Now the phone is dead as a brick. The issue is I had a ton of photos and videos from a year before that I was waiting to transfer once I got a new computer.
I have read on Apple websites, etc., that there is nothing to do for me. That all data has been erased already (which I didn’t think was a possible thing through restoring an OS on an otherwise functioning device, I admit I was completely ignorant of that fact).
I am looking around to know if there is any way that the data can actually be retrieved from a “dead” device like mine. Like bypassing whatever restoration was in process and just transfer the images and videos in any format whatsoever. This is mostly all I want, it’s more important to me than the device itself. Even if I’m having to learn an important lesson, I hope something can be done. I am getting a new device soon as I don’t want to mess with the frozen one.
Please enter the result of the calculation above.
Save my name, email, and website in this browser for the next time I comment.
Δ
Speak to a Specialist Now
Get Help Now