4 Replies Latest reply: Feb 1, 2013 11:36 AM by John Galt
rexgray Level 1 (0 points)

As stated in the title, I am a forensic examiner, although most of my work is on Windows devices. My problem is an iPod 5G with Touch Wheel that I received to exam, and I have not been able to get anything from conventional methods. But not really understanding enough about the Apple architecture and iPods, when I plug it into a computer, it appears to be in Recovery Mode, and calls for a Restore. The questions I have are:

 

1) How does the iPod get into Recovery mode

2) How to get it out of Recovery mode

3) But more importantly, what does Restore do to the device? If there happen to be items of interest (pics, videos, etc), does the restore affect them?


iPod touch
  • lllaass Level 10 (176,034 points)

    - You can place the iPod in recovery mode by:

    Recovery mode

    or by using this program (there are others too)

    RecBoot: Easy Way to Put iPhone into Recovery Mode

    - Many internal errors in the iPod resul in the iPod going automaticlly (default) into recovery mode.

    - Usual method is to restore the iPod via iTunes to get the iPod our of recovery mode.

    iTunes: Backing up, updating, and restoring iOS software

    Sometime RecBoot will do it if the iPod was intentionally placed in recovery mode

    - Unless RecBoot or similar will get the iPod put of recovery mode the iPod will be erased. Restoring the iPod erases the iPod.

    - For more inbfo on recovery mode see:

    http://theiphonewiki.com/wiki/Recovery_Mode

  • John Galt Level 8 (45,978 points)

    First identify the iPod: http://support.apple.com/kb/HT1353

     

    1. The usual cause is that its OS has been corrupted for a variety of reasons, and needs to be reinstalled before the iPod can do anything at all.

    2. The usual method is to restore the iPod, which completely erases it, and addresses question 3. Depending on the model iPod, computer-resident data recovery software may be useful to extract its existing content.

     

    Click wheel iPod models with cameras (such as the fifth generation iPod Nano) can record video or photos. Otherwise, any photos or videos must originate on a computer.

  • rexgray Level 1 (0 points)

    John - apprecite the info. Don't know what had transpired before the iPod was seized, i.e., could have been erased, wiped, etc but wanted to tred lightly on any action that might overwrite or erase data on the iPod. Since I don't have a computer that suspect might have synced with, probably gone as far as I can on this exam.

  • John Galt Level 8 (45,978 points)

    I think you have too, but depending on how much more time and effort you need to expend you could research commercial PC or Mac data recovery software. Don't restore it since this will certainly erase its content.

     

    The iPod's storage (disk or solid state memory) resembles any other storage device, but depending on the extent of the corruption it may or may not be readable.