Hacker News Reader

Comment by jgrahamc | Hacker News Reader

How is this 'forensics' and not 'hacking'?

A lot of computer forensics is hacking commoditized for law enforcement. If there is data you need to analyse that you can't get you need to "hack" it.

See for example - http://www.lostpassword.com/hdd-decryption.htm

Funky, it uses a firewire exploit.

It's based mostly on intent, I believe.

forensics uses hacking to get at data.

I think this is from a book (?) on general iPhone Forensics (which in my experience is a wide and incredibly tedious field :P) so hence the Forensics title I guess.

Bought the eBook version when a friend's iPhone got wedged during an update, and an Apple Store "Genius" recommended proceeding with a reformat, losing hundreds of baby pictures.

Was able to recover 90%+ of the images using the jailbreak/dd/file-carver technique as outlined in the book. So, thanks, "iPhone Forensics"!

Why only 90%? I would naively expect that you'd either be able to get in and recover them all, or not.

Well, if reformatted and updated/reinstalled then it possibly overwrote some of the deleted sectors - rendering some files unrecoverable.

As well as the potential overwriting. File carvers have trouble recovering fragmented files. They might produce corrupted files, or nothing depending upon the details of the file format.

The update that hung (and was forced-to-completion by allowing a reformat) was a major revision. (It might have been IPhone OS 1->2, even... I don't recall) So not only did the reformat touch sectors all over, but the package of standard stuff grew, and I even think Apple's default partitioning scheme may have been adjusted as part of the update.

Reply on news.ycombinator.com