Unallocated Space about iphone-dataprotection HOT 12 OPEN

Indeed this is a tricky question. An idea would be to first look for cprotect 
attributes of deleted files (using a tool like filexray) and then try each of 
these file keys on all the unalocated blocks.
Another idea would be to create a raw dump of the nand memory to include blocks 
hidden by the FTL/VFL layers. Since the encryption IV depends on the logical 
block number you'd need to do the reverse translation (physical page number to 
logical).

Does emf_decrypter extract and decrypt individual files or does it produce a 
decrypted raw dump that i can use winhex on?

it decrypts the raw dump "in place" but does not decrypts the unallocated space 
because this is non-trivial.

Jean, Thank you and your partner for both your hard work. I got all tools to 
compile and work as described. Hopefully in the future this tool or hfsexplorer 
will support the decryption of unallocated data.

i just committed a proof of concept implementation of a recovery technique 
using the journal file, based on this paper :
http://www.dfrws.org/2008/proceedings/p76-burghardt.pdf
http://www.dfrws.org/2008/proceedings/p76-burghardt_pres.pdf

It can help recover a few deleted files, depending on the state of the 
partition when the image was acquired.

at this point, other than the amazing progress already done, it means i will 
have to keep my 30Gb dd image of my iphone's data partition until progress is 
made for that unallocated space.

To clarify - does this mean that those of us who want to pull a dd image off an 
ios 4 device and decrypt it in order to run tools like photorec to recover 
deleted images are wasting our time?  

yes, photorec cannot work on ios 4 dd images since the unallocated space will 
be encrypted.

It turns out it is possible to read the raw NAND and recover deleted files due 
to the way the FTL works. However you need to acquire a NAND image, this will 
not work on dd images.
See http://esec-lab.sogeti.com/post/Low-level-iOS-forensics and the updated 
README for more info.

Hello!
Is it possible to read the NAND of a 4s device? It runs FW 5.1.1.
I need to recover one video file.

[deleted comment]

@Hybrid-Heaven it is not possible yet, some things have to be fixed in the nand 
dumper, and the new FTL used on A5+ devices must be reversed to adapt the 
undelete technique (issue 61).