Oh no! I have a wiped iPhone, now what?
![Image](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi6xIfngOuvXrGpaenivhwwqQadArE3RoQ9MynGYodzJ1SjdkoYvo1KOqbz23sL8xmL9t7IAxSgrKELQZZ6NEBRYFJu3wWr1ZxBQOW3lBtjyCq5gtrLgBKemMqluauKuC5lvteSiMW7t1Y/w296-h640/image.png)
One of the most common questions I got asked during presentations and conferences is: " During a search and seizure we found a wiped iPhone, what can we do next? " First and foremost: you cannot recover data stored on the device before wiping occurred . The encryption keys you need to decrypt the data are gone forever. Full stop :) If you are aware of any method, technique, tool or magic box that can do that, please let me know :) You have three options to recover data: Data stored on computer (s) (Windows or Mac) On Windows you can search for Lockdown certificates C:\ProgramData\Apple\Lockdown iOS Backups C:\Users\<username>\AppData\Roaming\Apple Computer\MobileSync\Backup C:\Users\<username>\Apple\MobileSync\Backup Synced CrashLogs C:\Users\<username>\AppData\Roaming\Apple Computer\Logs\CrashReporter\MobileDevice MediaStream C:\Users\<username>\AppData\Roaming\Apple Computer\MediaStream\ iPodDevices.xml C:\Users\<username>\AppData\Local\Apple