iPhone data recovery software, and the free routes to try first

What these tools say they need before they can recover anything

Before any iPhone data recovery software opens a single file, it needs one of two things to already be true, and the vendors say so themselves. CleverFiles, which sells Disk Drill, states that data recovery software like Disk Drill cannot recover information from a dead iPhone, because the device must be working and recognised by the operating system before it can be scanned. FoneLab’s own product page draws a similar line, and lists three recovery modes: one needs “The device is working normally and can be connected to a computer”, another needs “A previous backup exists on a computer” — from iTunes, Finder, or the Apple Devices app — and a third works from an iCloud backup instead, when neither of those is available. All three still come down to the same two things described above: a working, connected phone, or some kind of existing backup.

CleverFiles goes further and says “Recovering deleted files from an iPhone without a backup is nearly impossible” — a vendor stating the limits of its own product, not a competitor’s complaint. That lines up with how professional forensic tools work too: a 2020 peer-reviewed study of iOS forensics notes that analysing an existing iTunes backup file is itself one of the acquisition options, since most mobile forensic tools can open and read backup files directly, without ever touching the phone’s own storage. Put the three together and the shape of the problem is the same whichever side describes it: a working, unlocked, connected phone, or an existing backup. Nothing promises a route around both.

Why the phone’s own storage is off-limits

Apple’s own Platform Security Guide explains why a connected, powered iPhone is not the same as a readable one. Its Data Protection overview says the technology protects data stored in flash storage on every device built around an Apple SoC, including the iPhone, and that it “is controlled on a per-file basis by assigning each file to a class”: whether a given file can be read depends on whether that class’s keys have already been unlocked.

The mechanism behind that is hardware, not software. Apple says every time a file is created on the data volume, Data Protection generates a new 256-bit key for that one file and hands it to a hardware AES engine, which encrypts the file as it is written to flash storage. A 2020 peer-reviewed study of iOS device forensics, independent of Apple, describes the same hardware from the outside: a dedicated AES 256-bit crypto engine sitting between the flash storage and the system memory, with the keys themselves “fused into the secure enclave and encryption processor during manufacturing” — not loaded afterwards, not configurable, fused at the factory.

What it actually takes to force your way in

Not every byte a forensic investigation wants is sitting in a backup by design. The UK’s National Cyber Security Centre, writing guidance for app developers rather than for recovery software, tells them to mark sensitive data with the “do not back up” attribute specifically so those files are never included in an iTunes or iCloud backup — one reason a backup alone does not always have everything a phone holds, and why forcing a way into the device itself is sometimes the only route left. Apple’s own encryption is built to make that route hard: since iOS 8, the 2020 peer-reviewed study notes, the data partition has been encrypted with a key derived from the user’s passcode, and it stays encrypted “until the device passcode is entered”.

Forcing it anyway has, historically, needed something other than ordinary software. The same study recounts that the legal dispute between the FBI and Apple ended only after the FBI said it had got into a locked iPhone through a bootloader vulnerability discovered by the Israeli company Cellebrite — and that GrayKey, a separate tool from Grayshift, works by exploiting an undisclosed flaw in the secure enclave processor, the same chip that handles the iPhone’s encryption. Even then, the study says reaching deeper data on a modern iPhone will usually require jailbreaking it first, a process that changes the file system and can alter the evidence being recovered. None of it appears in what the consumer programs read for this guide describe.

What a backup actually contains — and what iCloud sync already removed from it

A backup and a sync are not the same thing, and Apple’s page on what iCloud backs up says so directly: “Any data on your device that isn’t regularly synced is stored in your iCloud Backup” — which means anything that already syncs continuously does not wait for the nightly backup to copy it. Messages is the clearest case: with Messages in iCloud turned on, Apple says messages “automatically sync to iCloud so they aren’t included in your daily backup”. Photos works the same way: with iCloud Photos on, photos, videos and face information sync to iCloud and, again, are left out of the daily backup. The same logic reaches further than Apple’s own apps — an app that stores its data through iCloud Drive keeps that data in iCloud instead of in the backup, and a paired Apple Watch’s backup rides along inside its iPhone’s backup rather than living in a separate file. How these two kinds of backup are set up in the first place is covered in full in backing up an iPhone.

What actually sits inside a backup also depends on whether it is encrypted. Apple’s page on encrypted backups says a backup made in iCloud “encrypts your information” automatically, every time — but a backup made on a computer “isn’t encrypted by default”, and only becomes one once the password-protected Encrypt local backup option is switched on. The difference is not cosmetic: encrypted backups, Apple says, “can include information that unencrypted backups don’t” — saved passwords, Wi-Fi settings, website history, Health data and call history. An unencrypted computer backup, the default kind, simply does not carry any of it.

One more detail matters if iCloud Backup has ever been switched off on a device: Apple keeps whatever backups were already stored in iCloud for 180 days before deleting them, so turning the feature off is not the same as losing them immediately. The backup fundamentals that apply beyond the iPhone, on a computer, are a separate subject, covered in backups, properly.

How many days you actually have, and why Apple gives two different answers for Messages

For photos, notes and files, Apple is consistent across its own pages. Apple says that when you delete photos and videos, “they go to your Recently Deleted album for 30 days”, and after that they are permanently deleted; the iPhone User Guide says almost exactly the same thing — the full procedure, including where the album actually is, is in recovering deleted photos on an iPhone. Notes get an identical window: a deleted note sits in the Recently Deleted folder for 30 days before being permanently removed from the iPhone, iCloud, and any other device signed in to the same Apple Account. Files deleted from iCloud Drive or “On My [device]” in the Files app go into Recently Deleted too, and after 30 days they are gone — permanently and immediately, with no second safety net once that folder itself is emptied; the full set of options, including this one, is in recovering deleted files.

Messages is the one place where Apple’s own pages do not agree with each other. The iPhone User Guide states you can recover text messages you deleted on your iPhone “for up to 30 days”. Apple support article 102615 says instead that you can only recover messages and conversations “deleted within the last 30 to 40 days”. Both are live Apple pages; neither one is quietly wrong, and this page reports both rather than picking a winner — the procedure itself, and the three limits Apple states around it, are in recovering deleted messages on an iPhone. One more limit applies regardless of which number is right: if a message was deleted before the device updated to iOS 16 or later, Apple says it cannot be recovered at all, whichever window is used.

The free routes that work before you buy anything

The quickest recovery route for photos, notes, messages and files is Recently Deleted, already covered above, but Apple’s own pages add a few details worth knowing before relying on it. If a photo or video is missing from Recently Deleted, Apple says it may be sitting in the separate Recovered collection instead — not lost, just filed differently. A deleted shared note someone else owns will not show up in Recently Deleted at all, because deleting it only removes it from your own list, never the owner’s. In an iCloud Shared Photo Library, the same kind of rule applies: only the person who added a photo or video can permanently delete or recover it from Recently Deleted. And on iOS 18, the button that opens Recently Deleted messages is labelled Edit rather than Filters, which is why older step-by-step guides sometimes say the option is not there — it has just moved. Files recovered from Recently Deleted go back to exactly where they were before deletion.

Beyond Recently Deleted, restoring from a backup is the next free route. Apple’s current restore page walks through both versions: from iCloud, you review the date and size of each backup, choose the most recent one, and the device restores itself from it; from a computer, the same page points to the Finder on a Mac running macOS Catalina or later, or the Apple Devices app on a PC with Windows 10 or later, and if that backup is encrypted, restoring asks for its password. Apple is specific about the order of operations too: a device that has already been set up should be erased first, and setting a device up as new creates iCloud backups that replace whatever was saved before — a way to lose the very backup meant for restoring, if the steps run in the wrong order. The full walk-through, including when each option actually applies, is in restoring an iPhone from a backup.

The third free route covers narrower ground: contacts, calendars and bookmarks, through Data Recovery on iCloud.com. Apple’s own page says the tool lets you restore missing contacts or calendars from an earlier version, or restore missing bookmarks, and warns that if you recently made changes you might lose some data, recommending a backup first. Restoring a calendar is all-or-nothing — the version picked replaces the existing calendars on every device signed in — while restoring bookmarks lets you choose which ones come back, one at a time.