Will full file extraction with password damage my iPhone?

Belle2018pablo wrote:

Permanently deleted from the recently deleted album 15 days prior

Again, to be clear, that’s thirty days—not fifteen days—for media left in the deleted album, and then allowed to automagically permanently delete.

Once that media is either manually or automagically deleted from the deleted album, then the data is permanently deleted within the length of time the flash storage works through its erasure queue. Which is much shorter than fifteen days.

Seemingly nothing can be offered here that will be acceptable or will suffice for your needs though, given the clearly sensitive nature of the data. So best don’t have that data within reach of your perceived threats.

And if the data is sensitive enough, factory reset the device.

Or destroy the device. Grinding and melting the equipment into slag is the norm in some data security environments.

Belle2018pablo wrote:

So permanent isn’t so much permanent as you previously mentioned lol

Potentially-sensitive information can sometimes be inferred from the physical and chemical composition of the hardware involved, yes. Even slag can contain clues.

Some data and related practices are more sensitive than others, and some activities can have political or legal entanglements.

Which means you need to perform a systematic security review of your data and data preservation practices, your device hardware and any local networking equipment, local backups, and the rest, and then decide the appropriate course.

Given your preference for absolute certainty in what is clearly a hostile environment, factory reset minimally, or grinding and slagging the hardware are probably in your future, any discussions of flash data remanence aside.

And best avoid even having such sensitive data at all.

frosty130 wrote:

Hi I have been following this thread and I have similar concerns, seen you give good advice before to other users, what is your opinion on the 15 days after deleting? Is that sufficient time to make the data irrelevant? Especially if your adding more and more data each day, and I heard when you uninstall an app and the reinstall the app the SQLITE databases are vacuumed out so the new installation can start its own database, what are your thoughts

Either erase the device, or physically destroy the device.

Better still, acquire security advice tailored to your personal requirements, context, and specific situation.

For information on the forensics tools involved here, contact the forensics tool maintainer.

Whether any particular forensics apps are read-only snd benign, or might cause corruptions or utilize a jailbreak or create some other issue is best discussed with the app maintainers.

Belle2018pablo wrote:

This question can go in two general directions.

One involves errant second deletion and data recovery.

The other direction involves data you don’t want exposed.

These two directions are mixed together in the following reply.

Ok I’ll try lol last time I will ask, is 15 days after permanently deleted files enough to make it unrecoverable

Deleted photo and video media is permanently deleted from the deleted album after thirty days and not fifteen, or is permanently deleted after being deleted a second time from the deleted album.

If having repeated issues with an errant second deletion for some reason, I’d suggest adopting a backup strategy appropriate for the local need to both delete and then later recover the media, or switching to a photo storage app or service that permanently maintains all media.

Or store your photos somewhere other than in the deleted album and potentially somewhere other than in the Photos app library or iCloud Photos more generally.

…if I added another 160 files, photos videos ect, if you had the password to the phone could they be retrieved with forensic examination, just I heard so many conflicting information, some say yes others say no it’s impossible, how exactly can you be confident?

A compromised device passcode is a problem, yes.

Knowledge of the passcode can be used to view the deleted album, as well as the entire contents of the photo library, as well as other shenanigans potentially barring having previously enabled Stolen Device Protection or such.

Do you have any experience or experienced knowledge about iPhones and deleted files, thanks,appr it if you respond

Deletion of data stored in flash is permanent just as soon as the device prepares the sector for re-use. (See my wall of text embedded-quoted in a reply above)

If you’re concerned about deleted photos and (transient) flash storage data remanence combined with a compromised passcode and/or compromised biometrics, and particularly also involving somebody potentially running forensics apps on your device and with your passcode (and not, for instance, for your own forensics-involving recovery of your own deleted data) or potentially using espionage techniques or tooling to access your data, then your security requirements may not or do not fit those that Apple has designed for here.

You will need another approach.

Maybe that alternative involves an encrypted-storage app of some sort.

Or an alternative that involves simply not having data that sensitive stored on a device that can be lost, or stolen, or potentially captured forensically and particularly with the passcode. Store and access that data somewhere more secure. Whether that might involve a second and dedicated iPhone with a robust twenty+ character password with MFA and a recovery key, or stored on a NAS on a secure protected network, or otherwise?

Some data is just too problematic or sensitive or classified or otherwise hazardous to have easily accessible. Don’t have that data exposed.

frosty130 wrote:

Yea I understand this is the best way, but I was asking for an opinion on the matter I asked, if you didn’t reset or destroyed the device, how long does this data stick around? Obviously If you have an understanding In such topics

Destroy the device, and destroy all devices this iPhone has been connected to, destroy all cables (many can have electronics, and some cables can be malicious), destroy all connected computers, everything. Because those too could each house sensitive data. You want to be sure here, so your option is to burn it all down and start over.

And I'm not being flippant.

You want certainty. Expect to pay for that certainly, and as part of that certainty expect to source new equipment, new credentials, new iCloud, everything.

And yeah, some of that data might still have leaked.

Given your situation the real answer is to restore the phone to factory settings using a computer. This makes the entire storage unreadable by trashing the storage encryption key.

What MrHoffman said.

Belle2018pablo wrote:

Comprehensive Data Access: Full File System Extraction provides investigators with access to the entire file system of a device, enabling them to retrieve a wide range of data, including deleted files, system logs, and application data, I have read on this community you can’t do this on iPhones? What is your thoughts

My thoughts are that you are 1) not accepting the answers given and 2) that you have yet to explain why you keep asking these questions. What exactly are you trying to accomplish?

Belle2018pablo wrote:

Ok I’ll try lol last time I will ask, is 15 days after permanently deleted files enough to make it unrecoverable if I added another 160 files, photos videos ect, if you had the password to the phone could they be retrieved with forensic examination, just I heard so many conflicting information, some say yes others say no it’s impossible, how exactly can you be confident?

Fundamental to flash storage technology, re-using flash storage requires that the storage be erased before it can be re-used and rewritten, and that erasure process is comparatively slow with flash. With flash, reads are fast, writes are fast, but erasure is both necessary and unfortunately comparatively slow. That speed differential means that the erasure operation preferably happens as soon as is feasible after the storage has been released from use. That sequencing makes the subsequent re-use of the storage much faster, as you’re not waiting for the erasure to happen before the rewrite and re-use; before the write. That also means there isn’t any data to recover. Not once the storage device has finished processing its pending-work (erasure) queue.

Moving the storage around at deletion would involve additional effort for something being deleted, and being permanently deleted, and that move would necessarily also use free storage. What I suspect you’re referring to here however is the process known as wear leveling, which doesn’t move existing storage contents around, it moves the storage used for new writes around.

Wear leveling exists as all storage has a useable life (a limit on the total numbers of reads or writes permissible), and with flash particularly. Rather than rewriting the same (physical) storage each time, each rewrite picks different (virtual) storage from the available storage pool, and re-maps it. An app writing to, say, (virtual) sector 1 in the storage pool each time actually writes to a different (physical) sector currently mapped as (virtual) sector 1. This remapping or wear leveling process avoids exceeding the total rewriting capabilities of a particular storage sector. Most (all?) modern hard disks have something similar to this mechanism, with sectors being remapped when storage errors occur; a so-called bad or defective sector list is maintained, and a spare “good” sector replaces (remaps) a bad sector.

And yes, flash storage also remaps sectors with detected errors. Same as modern hard disk drives.

Most devices are also over-provisioned; have more internal storage than was advertised, or was reported to the operating system. This is also why cheaper flash storage has fewer of these “spare” sectors—so-called over-provisioning—and why running flash storage near or at capacity can potentially also have a detrimental effect on longevity; why storage can sometimes wear more quickly, and why running near or at full is Bad.

The TRIM command mentioned above is one of various ways an operating system can inform the underlying storage of a status change for a particular part of storage. TRIM triggers the erase of the sector, and (indirectly) also the remapping of storage for wear leveling. Some configurations will use a sector-of-zeros write to trigger this same erase and remapping process, for instance. TRIM places the storage sector in a pending-erasure queue.

The traditional concept of data remanence or of “disk scavenging” is from the era of hard disks, as those don’t need to erase before the sector csn be re-used and rewritten, though operating systems can be implemented and configured to erase storage at discontinuance of usage (at deallocation). (This is also why some system configurations can respond to writes of zeros as a TRIM command, too.)

Now can you capture existing data in that pending-erasure queue? Maybe. If you can capture the remaining data immediately after the deletion, and before the device finishes processing its queue of storage sectors pending erasure; its TRIM queue. But while flash storage erasures are slow in terms of flash storage performance generally, they’re still pretty speedy in human terms, and devices are seldom powered down immediately after the deletion.

Which is a lot of words for this: permanently-deleted files are permanently deleted.

by MrHoffman (bold mine)

Do you have any experience or experienced knowledge about iPhones and deleted files, thanks,appr it if you respond

Only about 17 years.

You still haven't explained why you keep asking about file deletion. What is going on that prompts you to ask about this? What is your overarching concern?

Belle2018pablo wrote:

Permanently deleted from the recently deleted album 15 days prior

Permenantly: in a way that last or remains unchanged indefinitely; for all time.

Permanently deleted means....permanently deleted. As gone, no longer there, can't be recovered.

Belle2018pablo wrote:

So permanent isn’t so much permanent as you previously mentioned lol

Yes, for all practical purposes. If you have data that's sensitive enough to require destroying the device, you really should discuss this with your IT department. If you don't have one, hire a professional.