Recovered 2,117 photos from a 2019 iPhone backup

Cortiq@0xCortiq

🚨️️BREAKING : I DID IT WITH MY iPHONE 7 PLUS, RESTORE OLD PHOTOS & FILES.

Yesterday I found the 7 Plus in a drawer. Dead battery, cracked corner, still on iOS 15. I charged it, plugged it into my MacBook, opened Claude Code and typed roughly: “I deleted photos from this iPhone in 2019. Help me figure out, honestly, whether anything is recoverable. Don’t modify anything.”

The first thing Claude Code did was kill my main fantasy. It explained that since iOS 8, every file is encrypted with its own key. Once a file is deleted and Recently Deleted is emptied, that key is thrown away. The data might physically still exist in flash memory for a while, but without the key it’s noise. Five years later, on a phone I’d used daily until 2021, it’s overwritten noise. No command brings that back.

What it said next is what mattered: “Stop looking for the deleted file. Look for a copy that was made before you deleted it.”

So we made a list of every place a copy could have ended up:

local backups on any computer this phone was ever plugged into;
iCloud backups and iCloud Photos;
apps that auto-upload: Google Photos, Dropbox, Telegram, WhatsApp;
anything I’d sent to someone else.

On the phone itself we looked at a few things. Using libimobiledevice, we pulled device info and made a fresh full local backup of the phone as it is now. Inside, Claude Code queried the Photos database (Photos.sqlite) to see what it still referenced. It also flagged one thing as experimental: SQLite databases sometimes keep traces of deleted rows in unused pages. Filenames, dates, maybe GPS coordinates, but never the image itself. We tried it and got a list of filenames from 2019. No photos. That was the honest outcome, and it was still useful, because it told me the exact dates I was looking for: March 2019.

Then I remembered something. Back then I didn’t have a Mac. I used to sync the phone to my mom’s old Windows laptop to free up space.

The laptop was still in her closet. I booted it, went to C:\Users\<name>\Apple\MobileSync\Backup\ and there it was: one backup folder, last modified February 2019.

I copied it to my Mac (copy, never work on the original), and Claude Code walked me through reading it. An iOS backup isn’t a normal folder. It’s thousands of files with hashed names, plus a database called Manifest.db that maps each hash back to its real path. The backup wasn’t encrypted, so we could query it directly. We filtered for CameraRollDomain and the Media/DCIM path.

2,117 photos and 96 videos. Restored with their original filenames and dates.

Video number 31 is my grandfather in the garden. Forty-two seconds. He’s laughing at me because I’m filming instead of helping.

There was one more surprise. The Notes database had a note from 2018 called “wallet” with one line: “words in the blue notebook, last page.” I’d bought about $60 of a coin during the 2017–2018 hype through a wallet app and forgot about it completely. The backup didn’t contain the recovery phrase. Unencrypted backups don’t include the keychain, and the app didn’t store it in plain files. But it told me where I had put it. The blue notebook was in a box in the garage. Last page. Twelve words.

I’m not telling you what it’s worth now. I’m telling you to go check your old laptops.

What I learned: the deleted file on the phone was never coming back. The copy I’d made without thinking, years before, was there the whole time.

Full prompt shared below in comments.