iphone 5s bad updat...
 
Notifications
Clear all

iphone 5s bad update - data recovery plan?

5 Posts
4 Users
0 Likes
948 Views
 R720
(@r720)
Posts: 1
New Member
Topic starter
 

First post - want to start off by saying great forum, wealth of information, glad there's somewhere to discuss these topics.

I'm trying to help a client get a year's worth of data back after quite a bit of bad timing. Device is in excellent physical condition and works correctly. In the week prior, they had to reinstall Windows on their pc, which wiped out their itunes and backups. They don't use iCloud, so that option is not available. Before they thought to reinstall itunes and make a backup, their phone went through the auto update notification process and subsequent installation for ios 10.2, which they had previously selected to install "later". Then the following happened

1. Iphone 5s (A1533, Verizon/CDMA) updated to ios 10.2.
2. Update process required the client to create a 6 digit passcode, without option to skip, so they wrote down the code on paper, and verified twice during the setup process. Client previously had no passcode, therefore the option for "erase data after 10 failed attempts" was not selected.
4. After the phone rebooted, the phone would not accept the newly created passcode. I don't know if this is due to a bad software update, or a hardware glitch.
5. Client entered the passcode until the phone displayed "disabled, connect to itunes".
6. Client installed itunes on their pc, but itunes did not recognize the phone due to it being disabled.
7. Client put phone in recovery, reconnected to itunes, and choose to "update" the phone rather than "restore" in order to preserve the data, hoping it was a bad update. This reinstalled ios 10.2, but had no effect on the passcode lock.
8. Phone currently is in the disabled state "iphone is disabled, connect to itunes", but accepts incoming phone calls.

This situation is unique since the passcode is known. I don't know of any out of the box methods (IP-box, MFC dongle, svStrike, Cellebrite, etc) to crack a device with a secure enclave (iphone 5s and up) and 6 digit passcode. The only plan I can think of is to downgrade the phone to ios 8 / 7 (instead of the default update in 7 above, alt-click and select downgraded IPSW file), and subsequently try IP-box (limited to 4 digit passcode) or svStrike. However, since the IPSW for ios 8 or 7 is no longer signed, and the device is not jailbroken, I don't believe the iphone will accept the downgrade. Additionally, a tool like Cellebrite UFED only works up to ios 5, and Cellebrite unlocking services don't apply to iphone 5s and up.

Questions
1. If the "erase after 10 failed attempts" is not selected before an update, and during the update, the passcode selection is implemented, does this enable the erase data feature?
2. What options are available given the passcode is known, and the client only cares about the data?

Just trying to help someone get their data back, which contains lots of birthdays, charity, and pictures of a loved one that passed away.

It's quite beyond the scope of the easy unlocking of phones I've done due to the secure enclave and up-to-date ios 10.2. Any help or suggestions would be great.

 
Posted : 24/01/2017 4:03 am
(@louise-h)
Posts: 8
Active Member
 

Hi,

Sounds like a bit of a pickle to me. To my knowledge you cannot downgrade from iOS 10.2 to iOS 8/7? I've seen people able to downgrade iOS 10.* to 9.* but that's about it.

I know they've lost their iTunes backup files but have they been backing up to iCloud? You can restore the device from there (if find my iPhone is enabled).

https://www.imobie.com/support/downgrade-from-ios-10-to-ios-9.htm

https://canijailbreak.com/

https://ipsw.me/#!/platform

L

 
Posted : 30/01/2017 5:47 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I know they've lost their iTunes backup files but have they been backing up to iCloud? You can restore the device from there (if find my iPhone is enabled).

They don't use iCloud, so that option is not available.

roll
jaclaz

 
Posted : 31/01/2017 4:32 pm
(@louise-h)
Posts: 8
Active Member
 

Oh well. That's a no then.

 
Posted : 01/02/2017 9:13 pm
Mark_Eskridge
(@mark_eskridge)
Posts: 50
Trusted Member
 

Have you attempted a forensic recovery of their original (deleted) iTunes folders from the drive?

 
Posted : 02/02/2017 9:28 am
Share: