I am a forensic examiner with an iPod 5G in Recovery Mode. As a 'non Apple' person, what does 'restore' imply with reference to the 5G? Does it affect any data on teh iPod, like pics, and videos?

Question

Level 1

0 points

I am a forensic examiner with an iPod 5G in Recovery Mode. As a 'non Apple' person, what does 'restore' imply with reference to the 5G? Does it affect any data on teh iPod, like pics, and videos?

As stated in the title, I am a forensic examiner, although most of my work is on Windows devices. My problem is an iPod 5G with Touch Wheel that I received to exam, and I have not been able to get anything from conventional methods. But not really understanding enough about the Apple architecture and iPods, when I plug it into a computer, it appears to be in Recovery Mode, and calls for a Restore. The questions I have are:

1) How does the iPod get into Recovery mode

2) How to get it out of Recovery mode

3) But more importantly, what does Restore do to the device? If there happen to be items of interest (pics, videos, etc), does the restore affect them?

iPod touch

Posted on Feb 1, 2013 11:01 AM

Reply

Answer 1

lllaass

Level 10

210,417 points

Feb 1, 2013 11:15 AM in response to rexgray

- You can place the iPod in recovery mode by:

Recovery mode

or by using this program (there are others too)

RecBoot: Easy Way to Put iPhone into Recovery Mode

- Many internal errors in the iPod resul in the iPod going automaticlly (default) into recovery mode.

- Usual method is to restore the iPod via iTunes to get the iPod our of recovery mode.

iTunes: Backing up, updating, and restoring iOS software

Sometime RecBoot will do it if the iPod was intentionally placed in recovery mode

- Unless RecBoot or similar will get the iPod put of recovery mode the iPod will be erased. Restoring the iPod erases the iPod.

- For more inbfo on recovery mode see:

http://theiphonewiki.com/wiki/Recovery_Mode

Reply

Answer 2

John Galt

Level 10

141,332 points

Feb 1, 2013 11:15 AM in response to rexgray

First identify the iPod: http://support.apple.com/kb/HT1353

1. The usual cause is that its OS has been corrupted for a variety of reasons, and needs to be reinstalled before the iPod can do anything at all.

2. The usual method is to restore the iPod, which completely erases it, and addresses question 3. Depending on the model iPod, computer-resident data recovery software may be useful to extract its existing content.

Click wheel iPod models with cameras (such as the fifth generation iPod Nano) can record video or photos. Otherwise, any photos or videos must originate on a computer.

Reply

Answer 3

rexgray Author

Level 1

0 points

Feb 1, 2013 11:22 AM in response to John Galt

John - apprecite the info. Don't know what had transpired before the iPod was seized, i.e., could have been erased, wiped, etc but wanted to tred lightly on any action that might overwrite or erase data on the iPod. Since I don't have a computer that suspect might have synced with, probably gone as far as I can on this exam.

Reply

Answer 4

John Galt

Level 10

141,332 points

Feb 1, 2013 11:36 AM in response to rexgray

I think you have too, but depending on how much more time and effort you need to expend you could research commercial PC or Mac data recovery software. Don't restore it since this will certainly erase its content.

The iPod's storage (disk or solid state memory) resembles any other storage device, but depending on the extent of the corruption it may or may not be readable.

Reply