The Paraben’s iRecovery Stick is an USB flash drive designed to recover deleted data from the Apple iOS devices like iPhone, iPad & iPod touch. The product allows the investigators to recover data either directly from the device or from the iTunes back-up files. It is designed to support all iOS versions ranging from 1.x to 6.x and it works with iPhone 3GS, 4, 4S, 5 & other iOS devices. The iRecovery stick will not only recover the deleted data, it also downloads all the contents of the device. The article explains the usage of iRecovery stick and covers the pros and cons of it.
iRecovery stick features:
- Downloads phone contents – downloads all the user data like photos, contacts, calendar, etc.
- Recovers deleted data – recovers deleted text messages, contacts, call history, etc.
- Easy to use – simply connect the iPhone and the iRecovery stick to the computer, then click the start button in the recovery software.
- Portable – It is an USB thumb device and easy to carry.
- Inconspicuous – It resembles a commonly used USB thumb drive, so it can be used as a spy device and no one would suspect that the device is used to recover data from the iPhone.
- Works on backup files – recovers data from iTunes backup files.
The iRecovery stick shipment box contains the iRecovery stick and an USB cable that is compatible with the iPhone 3GS, 4 & 4S. The iRecovery stick is compatible with Windows XP & 7 and provides an easy-to-use user interface. iRecovery stick does not support vmware/virtualbox environment and Linux & Mac OS X operating systems. Also, it is mandatory to turn off the antivirus software running on the Wndows OS for better data recovery. The iRecovery Stick is a portable and a simple to use USB flash drive which contains the recovery software – iRecoveryStick.exe. Recovery software included in the iRecovery stick can be installed on to the hard drive or it can be executed directly from the USB drive. Below image displays the contents of iRecovery stick USB drive.
Installation of the iRecovery software is well documented in the iRecovery Getting Started manual located in the USB flash drive.
Data acquistion and Recovery from the device:
The iRecovery Stick is very simple to use. Simply connect the iPhone to a Windows based computer with the USB cable and then connect the iRecovery stick to the same computer throuh an USB port. Once the two devices are connected, run the iRecoveryStick.exe program. Welcome screen of the iRecovery stick software is shown in the below image.
Once open, click on start recovery button (highlighted in the above image). Then the recovery software prompts to choose connected device as shown in the image below.
Click on the device to start the recovery process (shown in the below image). The data recovery process will take several minutes to few hours to complete based on the size of the iPhone disk. During a test on Intel i5 2nd generation processor laptop it took 14 minutes to recover 256MB data from the iPhone 4.
The recovery process acquires existing data and recovers deleted data from the iPhone, but the majority of the data will be normal user’s data which has never been deleted. Once the recovery process is completed, then it immediately displays all the data recovered from the iPhone (shown in the below image). The recovery process downloads the existing contents of the phone such as contacts, call history, text messages, calendars, notes, pictures, multimedia and all other user’s data like safari history, safari bookmarks, GPS history & application cookies. It also recvovers different types of deleted data including text messages, contacts, call history, and calendar entries. The iRecovery stick is not capable of carving the file system, so it can only recover the deleted data from the Sqlite database files and does not recover the deleted files from the file system, i.e it does not recover the deleted photos.
The user interface also provides an option to generate easily readable report or to export the recovered data to Excel sheets. During a test, export to Excel option took more time than the actual recovery process.
The iRecovery stick does not have the capability to bypass the iPhone passcode. So if the device is protected with a passcode, unlock it before connecting it to the computer for recovery.
Data acquisition and Recovery from the backup:
The iRecovery Stick can also recover data from the iTunes backups. In general, iTunes backup contains a copy of everything on the device like contacts, SMS, photos, calendar, music, call history, notes, network settings, safari bookmarks, cookies and application data, etc. So the iRecovery stick recovers the same types of data it recovers from the iPhone itself. To recover data from the backups, run iRecoveryStick.exe and load the iTunes backup files created in Windows. Welcome screen of the iRecovery stick software is shown in the below image.
Click on start import from iTunes backup button (highlighted in the above image). Then the recovery software prompts to choose specific iOS version as shown in the image below.
Clicking on the specific iOS version prompts the user to open the existing iTunes backup as shown in the image below. In general iTunes backup gets stored in the below locations.
Windows XP – C:\Documents and Settings\[user name]\Application Data\Apple Computer\MobileSync\Backup\
Windows 7 – C:\Users\[user name]\AppData\Roaming\Apple Computer\MobileSync\Backup\
Once the backup is selected, then the recovery process gets started. The data recovery process will take several minutes to few hours to complete based on the size of the backup files. During a test on Intel i5 2nd generation processor laptop it took 15 minutes to recover 300MB data from the iTunes backup.
Once the recovery process is completed, then it immediately displays all the data recovered from the backup files. The recovery process extracts the existing contents from the backup such as contacts, call history, text messages, pictures, multimedia and all other user data like user’s internet browsing history & application cookies. It also recvovers different types of deleted data from the backup including text messages, contacts, call history, calendar entries and notes.
The iRecovery stick can only recover data from the iTunes normal backups and it does not work with the iTunes encrypted backups.
What data is recovered:
Once the recovery process is completed, iRecoveryStick displays the recovered data in an easy readable format as shown in the image below.
The recovery process recovers the below existing data from the device/backup:
- Messages – sent/received SMS messages including the exact date and time.
- Contacts – phonebook data with creation and modification dates.
- Call history – call logs including the exact duration time.
- Graphics – photos & thumbnail images.
- Organizer – calendar & notes.
- Multimedia – mp3 files & recorded videos.
- Internet data – safari history, safari bookmarks, safari suspend state, safari cookies, email accounts, youtbue bookmarks and application cookies.
- Tracking history – geographical locations. It contains longitude and latitude coordinates along with a timestamp and is displayed in the Google Earth viewer.
- Other data – this data includes maps history, maps bookmarks, maps directions and other properties.
The recovery process recovers the below deleted data from the device/backup:
- Recovered data
- Call history
- Calendar data
- Internet data
- Tracking history
The iRecovery stick does not recover data from the iOS keychain file. Also, it does not recover the deleted files & photos.
The iRecovery stick is a simple to use tool for data recovery from iOS devices. It recovers most of the data from the device, however it does not recover deleted files from the file system. Due to this limitation it may not be a great tool for forensic investigators. However this is the perfect device for employees, parents, spouses, boyfriends & girlfriends who wants to spy or recover the deleted SMS, contacts, call history and web history from iOS devices.
The paraben’s iRecovery stick costs around 200$. So in my personal opinion, I feel it is worth for money.