iPod – Imaging and Data Recovery

One of the guys from the Nashville Mac Users group asked me about recovering some audio files from an iPod.  A friend of his used an iTalk to record some audio.  About 200MB with of audio file.  For some reason it is not sync’ing from the iPod.  He also has no idea which of his many macs is the master to the iPod.  He would have to let it wipe it out to associate it to a new mac he is sure of as the master.  So I got to playing around.   My iPod is in disk mode.

  1. Open Terminal
  2. df
    This command shows disc usage and what discs are mounted.  Notice below the iPod is shown and it is is disk2s3.  Keep in mind the main disk# can change every time you reboot if you have multiple external drives. 

    /dev/disk2s3                             117013560  93569848  23443712    80%    /Volumes/iPod

  3. I have an external sata with way more free space than my ipod is big. (60GB)
  4. dd bs=512 if=/dev/rdisk2 of=/Volumes/ExtSata/ipodimage.dmg
    This command does a disc image of the raw disk#2 matching up to what we saw in step 2 above.  You want the raw disk (rdisk) since it is faster for making an image.   So we use a block size of 512 (bs) from an input file (if) of /dev/rdisk2 to an output file (of) of /Volumes/ExtSata/ipodimage.dmg
  5. Wait a really long time (was over night) and when the dmg file shows in finder as large as the iPod close terminal, eject the real ipod and try double clicking on the new ipodimage.dmg file.

For me it opened up fine mounting as a disc image.  I could then browse  the contents of the iPod.  Of course I could feed it to one of my forensic tools since it is a disc image and easy to parse with file recovery tools etc.  Now that I know it works.  The question is can I use this to get past any issues on the fellow’s ipod to drag his audio files out of the disc image.  If we encountered any errors I would do the DD command again but add conf=sync,noerror at the end.

The noerror tells DD to keep going and not end if it hits an error.  The sync tells DD to  pad any error spots with null.  That is an attempt to get around any errors on the disc.