Making your iPhone (or iPod) Safe for Resale

Discussion in 'iPod touch' started by JBB, Jun 3, 2008.

  1. JBB

    JBB New Member

    Dec 29, 2007
    Likes Received:
    Thanks to NerveGas for the link.

    [Since my posts regarding the iPhone restore mode being insufficient for wiping data (and Apple's own refurbishing process also being insufficient), many have emailed me asking for instructions on how to properly wipe personal data off of the iPhone. I've been very quiet about how to properly lift data in a forensic manner, as my goal is to avoid seeing a bunch of evidence erasers pop up in the wild (I've already been approached by Symantec about this). What I will share, however, is the way in which I wipe my own devices before I resell them, which I believe the consumer has a right to do. Mind you, I make no guarantees about this and accept no responsibility for you hosing your iPhone. This is what works for me.
    Perform a full restore, but be sure to set the device up as a "new phone", rather than restore from a backup (of course). This destroys the live file system only, but isn't really necessary. I do this to be extra safe that no writes to the device occur after wiping (and if they do, will not include any of my personal data).
    Jailbreak the device using something like iLiberty+ and obtain shell access via ssh.
    Find a copy of 'umount' for the iPhone. This can be found on the RAM disk, or in other places. Don't ask me for it. Now force both mount points into read-only mode:

    # umount -f /private/var
    # mount -o ro /private/var
    # mount -o ro /
    NOTE: The GUI will be non-responsive when /private/var is mounted read-only, so be sure not to try and use it.

    Wipe both partitions clean by copying /dev/zero over them. Ideally, /dev/random would be better, but it will heat up the CPU considerably and take a much longer period of time. Unless you are trying to hide information from the CIA or some other organization with the resources to perform low-level NAND recovery, a single /dev/zero wipe will suffice:

    # cat /dev/zero > /dev/rdisk0s2; cat /dev/zero > /dev/rdisk0s1
    After complete, force the device into recovery mode (Home + Power until "Connect to iTunes") and then perform another full restore.
    If you are paranoid about a low-level NAND recovery, use /dev/random and repeat these steps about seven times - or simply take a sledge hammer to the device.
    The entire process takes a considerable amount of time - perhaps an hour or two if you get good at it. It's not something anyone is going to be able to pull off if they hear sirens approaching, and so essentially this is only useful for legitimate consumers selling their devices. I'd also recommend wiping any devices you might happen to purchase, to prevent someone else's incriminating evidence from haunting you should the device ever be examined. What doesn't work is simply filling your device with music. For one thing, there is a significant amount of deleted data sitting in live files, so you'd need to restore first. Secondly, as with all Unix systems, the iPhone reserves a certain amount of space on the disk, so even if you were to cat /dev/zero > /private/var/tempfile, it will fail out before the disk is entirely full. This method overwrites the raw device, which is much more effective. Because the root file system ceases to exist when the operation is complete, this will ultimately just hang, and your iPhone will become non-responsive until you force it into recovery mode. Ideally, this would work a lot better if a special ramdisk was created for wiping purposes. I personally just hex-edited iLiberty's.

  2. nbvikingsidiot001

    nbvikingsidiot001 Member

    Jan 28, 2008
    Likes Received:
    iPhone 4 (Black)
    cool nice find
  3. wearmaize

    wearmaize Active Member

    Feb 13, 2008
    Likes Received:
    iPhone 4S (Black)
    Sweet, although I'm not looking to sell my iPod anytime soon.
    Quick question though, does anyone know what data other iPods store? An iPod video won't have passwords to ebay accounts, but can they contain information about iTunes store accounts?
  4. dualcorex

    dualcorex New Member

    Sep 16, 2007
    Likes Received:
    how do you even find email accounts and passwords once it is restored? i wouldnt even know where to start.
  5. robcoffee

    robcoffee New Member

    Dec 31, 2007
    Likes Received:
    It works the same way as if your computer hard drive gets corrupted you can use programs to recover the data, or if you just delete stuff off your computer it is still there (until you overwrite it) The basic way I understand it is that data storage works in that you have a master file table that records the location of information on the media. When you delete it all that happens is the location is removed from the master file table - it is still there but because the location has been removed from the file table it has effectively gone. Various programs can bypass the master file and hunt out data on the media and recover it. If you then put new data onto the media eventually the old data will be overwritten and lost for good.

    The simplest way to clean an iPod or iPhone (especially for no Jailbreak) would be DFU restore and then fill it with Music or Video totally to overwrite any latent data, and then DFU restore again.

Share This Page