kernel_patcher.py not working about iphone-dataprotection HOT 9 CLOSED

you need to install pycrypto :
sudo ARCHFLAGS='-arch i386 -arch x86_64' easy_install pycrypto

Thank you!

Jean,

I've sucessfully dumped the iPhone file system onto the Mac.  I've used the 
undelete python codes.  Not much luck since then.  I'm looking for the pictures 
and videos that I have deleted on a particular date, any chance that you can 
help me out if they have been overwritten already or it's just me being stupid 
not able to recovery them?  Thanks.

P.S. the weird thing is that not all photos can be viewed, the ones that can't 
be viewed are reported as not in the correct format, just wondering if I have 
done the decryption correctly?

Best regards,

Marvin

the emf_undelete script cannot recover many things, so do not expect much from 
it.
about the files that cant be viewed, the files recovered by emf_undelete are 
not always valid because it only checks if the first block is ok, but it might 
not be able to recover all the others.

The ones that can't be viewed directly are the ones in the DCIM folder.  Does 
this mean I haven't decrypted the raw image correctly?

Here's a complicated thought to recover the lost file.  File keys in cprotect 
extended attribute, are they being stored in time order according to the file 
being created?  I know the exact date and roughly the time the file was 
created, so we can find the existing files' keys as reference to pinpoint and 
so isolate a few possible file keys and use them to decrypt the whole disk 
image again and try our luck?

I know it will take time, 16Gb is one hour for each trial but is it possible?  
I really need my file back.  Appreciate your help.  Thanks.

you mean when you mount the data partition image, some files are valid but 
others not ?

That's correct.  Some can be opened without problems but some are saying their 
format is not supported.  Have I done something wrong?  

did you made any progress ? can you try running the file command on the files 
that wont open to check if they contain valid data (for example "file 
/Volumes/Data/mobile/Media/DCIM/100APPLE/file_that_wont_open.jpg")

 how to make rebuild ramdisk for ios 7 please tech me details thanks you so much sir .... :) i can make this command " python python_scripts/kernel_patcher.py iPhone3,1_7.0.4_11B554a_Restore.ipsw "

I have this error how can i do bro ?

"Traceback (most recent call last):
  File "python_scripts/kernel_patcher.py", line 8, in <module>
    from Crypto.Cipher import AES
  File "build/bdist.macosx-10.9-intel/egg/Crypto/Cipher/AES.py", line 50, in <module>
  File "build/bdist.macosx-10.9-intel/egg/Crypto/Cipher/_AES.py", line 7, in <module>
  File "build/bdist.macosx-10.9-intel/egg/Crypto/Cipher/_AES.py", line 3, in __bootstrap__
ImportError: No module named pkg_resources"