Recently I found an old iPhone in the laundry room of my parents house, I asked if I could have it and they said sure. I tried to guess the password but couldn’t since based on the wallpaper, it seemed to have been my brothers. I could’ve just asked him for it but I decided that would be far, far too easy.
I went to my laptop and prepared to attempt to brute force the password since limera1n makes this trivial. This luckily was the past iPhone generation that makes brute forcing the password easy. So I got to work.
As I was going more though, I noticed that I can simply dump a tarball of all the phone’s data onto my laptop, I wanted to do that in case I somehow ruined everything so data like 15 year old photos were still recoverable if I somehow found a way to brick the device, which would be incredibly difficult since I was operating in the RAM while doing this “attack.”
The phone was still locked at this point and actually currently still is, I kind of gave up on the password since for my specific version I was gonna have to reverse engineer some stuff and I didn’t want to. But that hardly mattered since I’d already dumped all the data, the only remaining things on the device were passwords to their gmails and probably banking information, which I didn’t need.
Out of curiosity, I try to see what I can learn about what my 8 year old brother used his iPhone 4 for 10-15 years ago. Which is when the story takes a weird turn.
As I’m looking through the pictures, I see a LOT of images of my uncle’s kids. I see a good amount of messages with several adults at the time, and then I see somewhere else that has normal memes and pictures of basketball players of the day which is what I expected. I see texts about ordering paint…you get the drift.
These weren’t from an 8 year old.
So who were they from?
I ask my mom if she knew who had the phone before my brother, she says it was my dad’s before it was his. Gotcha. So that explains the paint stuff and the birthday wishes.
But why so many pictures of my uncle’s kids?
No, not what you’re thinking. This story doesn’t go there.
I look at a video, it’s my uncle’s wife and his kids at a basketball game. I hear his voice. So here’s what I’m putting together at this point:
My uncle owned the phone < gave it to my dad < my dad gave it to my 8 year old brother
Phone is still locked, I still haven’t actually gotten into the device. This was all reconstructed from the tarball.
Then I notice that the iCloud address was to my grandmas email.
Sigh.
So apparently she also owned the phone at some point? Not really sure on that one.
In total:
2100 messages were recovered, 243 photos, 15 videos, 113 contacts, 235 voicemails, 10 voice memos, 112 calls, 36 personal events, and 1647 of those messages were recovered after being deleted.
Every single one of those family members factory reset the phone before handing it to the next person to my knowledge, although I’m not 100% on that. I just know how my uncle was even then, very security cautious. And yet in about three hours I was able to recover 3-4 separate people’s entire footprint on that phone very easily.
What this means
For anyone wondering, modern iPhone’s are NOT like this. You can’t just pull a tarball and have seven years worth of information. They fixed the specific hardware flaw with the iPhone 5 that lets you run things before it boots meaning you can’t brute force anymore, but the security was so awful with this phone that I was able to get everything off of it without ever booting. I guess their passwords are safe though. That’s what matters I suppose.
And for the record, I did delete all that information as to not encroach on their privacy any further as none of that is any of my business. I’m about to just wipe the phone since I’ve got all photos off of it, which is what my intention was anyway.