06.05.2008, 13:28
![[Bild: prints.jpg]](http://www.zdziarski.com/images/articles/prints.jpg)
Wie Jonathan Zdziarski (NeveGas) in seinem Blog berichtet, bleiben persönliche Daten im iPhone nach manueller Löschung und der anschließenden Wiederherstellung der Firmware im iPhone erhalten. Dies habe er festgestellt als er die raw Disk nach dem Wiederhestellungsvorgang überprüft hatte. Ein freibleibender Teil des Speichers sei von der Wiederhestellung nicht erfasst worden.
In diesem Bereich des NAND Speichers befanden sich auch die Daten. Seiner Meinung nach heißt es, dass die Wiederherstellung eine Art "Quick Format" sei, D.h. bei der Wiederherstellung auf die gleiche Firmware, werden die Systemfiles auf alte Location geleitet. Der freibleibende Teil des Speichers bleibt unberührt.
Dies sollten alle berücksichtigen, die ihr iPhone entweder verkaufen oder im Garantiefall an Apple verschicken möchten.
Quelle: Jonathan Zdziarski
NerveGas schrieb:May 5, 2008: iPhone Users Beware: Restore Does NOT Delete Your Personal Data!
Many iPhone users have felt safe sending their phones into Apple or selling them on eBay with the feeling that their personal data and digital past have been erased by performing a restore. Think those embarrassing photos are gone for good? Think again. While the restore process takes long enough to make most people (including many well-respected iPhone developers) assume the "disk" stored in NAND memory is formatted, it actually isn't.
As part of my work on a forensics toolkit for the iPhone, I decided to test whether user data could survive a full restore in iTunes. There have been rumors floating around that the entire NAND is flashed to 0xFF when the device is restored, but this is untrue - this only occurs in a different part of the iPhone (the NOR), but not the NAND. To confirm this theory, I first deleted any backups of my device and then forced the iPhone into recovery mode. From there, I performed a full firmware restore of my iPhone, ensuring that no backups or syncing were performed. I then performed a basic recovery of the raw disk using the forensic toolkit I put together, and analyzed it. What I discovered was that deleted mail, contacts, and pretty much all of my other personal information was still residing in unallocated space on the device. My personal information was safe and sound, and available to anyone with the right skills to recover it.
What does this mean? This means that when you do a restore through iTunes, it is only the equivalent of performing a "Quick Format" on your iPhone. And for those of you who use "Erase all Content and Settings", this has even less of an effect, as it doesn't even destroy the file system. In both cases, all of the personal information that was sitting on the device prior to the erase or restore is still left sitting in the unallocated blocks of the iPhone's NAND memory. To make matters worse, the restore process is likely to restore the original operating system files over the same location as the old ones, meaning very little data is likely to be corrupted at all. Let this be a caution to everyone who sells used iPhones or sends their phone into Apple - you are releasing your personal data with it.
NOTE: I could use a couple more test phones, and at least one iTouch. Device donations or paypal graciously accepted.