Paraben Digital Forensic SolutionsData Recovery Products     Computer Investigation Products     Purchase     Support     Contact Us

iRecovery Stick FAQ

*Do not remove the stick from your computer while the program is running.

Watch the iRecovery Stick "How To" Video:

iRecovery Stick Demo Version:

What are the limitations of the demo version?
The following functions are available in the demo version:
  • Data recovery and acquisition
  • Viewing acquisition summary
The following functions are not available in the demo version:
  • Data import from iTunes backup
  • Viewing acquired data contents
  • Saving acquisition results
  • Saving and loading workspaces
  • Open data in Device Seizure
  • Workspace validation
  • Data export to MS Excel
  • Searching
  • Options
  • Bookmarks
How do I upgrade from the demo version to the full version?
You can select one of the many qualified resellers of Parabenís tools at www.paraben-sticks.com/buy.html

Can I just upgrade my iRecovery demo software on my computer?
No, a USB drive with the full version of iRecovery Stick must be shipped.

General Questions:

I start iRecovery Stick but a Driver Pack installation starts instead. Why?
The iRecovery Stick detected that you do not have the drivers necessary to perform the collection of data. This installation wizard will install the necessary drivers.

Do I have to install drivers on every time I start the program?
No, the driver installation is performed only once.

What does the iRecovery Stick do?
This program allows you to collect and recover data (including deleted data) from iPhone/iPad/iPod Touch devices or from iTunes back-up files.

Which devices does the iRecovery Stick support?
All devices with iOS versions from 1.x to 7.x are supported.

What data does the iRecovery Stick collect?
The iRecovery Stick collects the following types of data:

  • Contacts
  • Messages (SMS and iMessages)
  • Call history
  • Organizer
  • Graphics
  • Multimedia
  • Internet data
  • Recovered data (deleted data)
  • Tracking history
  • Other data not belonging to the listed categories
What types of deleted data are recovered?
The following types of deleted data can be recovered:
  • SMS history
  • iMessages
  • Notes
  • Call history
  • Contacts
  • Contacts properties
  • Safari web-browser bookmarks
  • Calendar
  • Cell locations
  • Wi-Fi locations
What Other data includes?
Other data includes the following types of data:
  • Device properties
  • Dynamic text
  • Address book images
  • Maps directions
  • Maps bookmarks
  • Maps history
  • Cell locations
  • Wi-Fi locations
How does the iRecovery Stick work?
It collects data directly from the device or from iTunes backup files, then it parses this data out into readable data while recovering deleted text based data.

Does the iRecovery Stick recover deleted data from iTunes backups?
Yes. iTunes backup files contains the same data collected directly from the device at the point in time of the backup. This data includes deleted data and can included data that has been since deleted from the phone but was saved in the backup file before deletion. For this reason, we recommend that you process the iTunes backup file even if you were able to get data directly from the device.

Can I collect data from a damaged device?
It depends on the degree of damage to a device. If the device is turned on, its OS is capable of functioning, and the device is currently not locked with a password, the data will be collected.

Can I perform a collection of data from a device locked with a password.
No, the device must be unlocked to perform the collection of data.

As an alternative, you can create a backup from a locked device and import data from the backup.

Do I need a SIM card to be inserted in a device to start collection of data?
No, you need only a device to be turned on and connected to a computer.

Does a device have to be jailbroken to perform a collection of data?
No, you can perform the collection of data from both standard and jailbroken devices.

Can I collect data from several devices simultaneously?
No. Data from only one device can be collected at a time.

Can I just collect deleted text messages without collecting everything else?
No. The process by which the iRecovery Stick gets access to any data requires all data to be collected.

There are several devices displayed Detected Devices page. What do I do?
Different devices are not marked differently in the iRecovery stick. To select the right device, disconnect all other devices.

How do I update iRecovery Stick?
To update iRecovery Stick, click Check for Updates in the Tools menu. If any updates are available, the updates downloading will start.

Can I run the iRecovery Stick without administrator permissions?
Yes, it is not necessary to have administrator permissions to perform a collection but you will require administrator permissions to install the driver pack if the necessary drivers are absent.

My stick is broken. What do I do now?
Visit support.paraben.com to request a replacement stick. You will be required so send in the broken unit.

The scan process seems to freeze and the program doesnít respond, why?
Some large files (such as videos) can make it appear that the program is frozen. Give it plenty of time before moving on to the next steps.

If the program doesn't resume after giving it plenty of time, it is likely the computer system ran out of resources or the data that the iRecovery Stick is trying to analyze is damaged or somehow preventing the collection from going through. Try restarting the program by terminating the iRecoveryStick.exe via the Task Manager and starting the program again.

All controls on the main page of the iRecovery Stick are disabled. Why?
It's possible that the flash drive from which you try to start the iRecovery Stick is not a genuine iRecovery Stick and therefore is not licensed. If you suspect you have been sold a pirated version, please contact us through support.paraben.com.

The program displays an error on startup or won't launch at all. Why?
Please start a support ticket at support.paraben.com.

Is there a help file for the iRecovery Stick?
Yes. To view the help file, click Help in the iRecovery Stick Help menu.

The collection process doesnít start, a message is displayed that an internal error with device communication has occurred. What is the problem?
There is a problem with the connection to the device. Please reconnect the device to a computer (or another port) and try performing the collection again. If that doesn't work, try a different data cable.

The iPhone hung. What do I do?
Reset the iPhone. Press and hold the Sleep/Wake button on the top of the iPhone for a few seconds until a red slider appears and then slide the slider. Then press and hold the Sleep/Wake button until the Apple logo appears.

The iPhone doesn't connect to the computer. What do I do?
Please try the following:
  • The iPhone battery might need to be recharged.
  • Change a cable or connect a device to a different USB port.
  • Turn the iPhone off and turn it on again. Press and hold the Sleep/Wake button on the top of the iPhone for a few seconds until a red slider appears, and then slide the slider. Then press and hold the Sleep/Wake button until the Apple logo appears.
  • Restart your computer and reconnect the iPhone to your computer.
  • Download and install (or reinstall) the latest version of iTunes from www.apple.com/itunes.
  • For iOS7, tap Trust on a device after connecting it to a computer.

iTunes Backup Import:

Why do I need importing from a backup?
iTunes backup files contain the same data that the iRecovery Stick collects from the phone. This can contain messages and other data the has since been deleted from the device but is still located in the backup data. Also, there may be reasons that you cannot collect data directly from the device. The iTunes backup importing is used as a secondary way to see what data was on the device.

What types of iTunes backup files can I import?
Data from iTunes backup for any iOS version can be imported.

Why is there no data in my backup?
The backup may be damaged or corrupted.

Can I import data from a backup copied from another computer?
Yes.

Can I import data from an encrypted backup?
Yes, but only starting with iOS 3.0. You will also need to know and enter the password for an encrypted backup.

Where can I find iTunes backups?
Depending on the OS, you can find it in the following locations by default:

  • Windows XP: C:\Documents and Settings\USERNAME\Application Data\Apple Computer\MobileSync\Backup\\Manifest.plist
  • Windows Vista/7/8: C:\Users\USERNAME\AppData\Roaming\Apple Computer\MobileSync\Backup\\Manifest.plist

Data Collection Process:

How long does the data collection process take?
It depends on the amount of data on a device. It can take as little as 25 minutes and as long as 10 hours. iTunes backup files process much faster than collections directly from the device.

How much space do I need for collected data?
It depends on the amount of data on a device but it is recommended to have the same amount of space as the total amount of device flash memory.

How can I save collected data?
You can define a default folder for collected data or you can define the location to which a workspace with the collected data will be saved after data collection procedure.

  • To define a default folder, click Options in the Tools menu and define the path to a default folder in the Default folder for workspace box.
  • To save data after the collection, click Save as in the File menu and define a location and a name of a workspace file.
Can I select which type of data can be collected?
No, all types of data are collected during the data collection procedure.

Does the iRecovery Stick recover all deleted data?
The iRecovery Stick can recover deleted data that has not been overwritten yet and only for the types of data listed above. If a part of recovered data was overwritten, its complete recovery will not be possible.

What happens to a device and data the on it if I stop the collection process?
No damage will be caused to a device or data on it. You can stop the collection at any time.

What happens to the already collected data if I stop the collection process?
The data will be saved to a workspace and will be accessible for viewing.

Collected Data:

Where can I find the collected data after closing the program?
The collected data is stored in a Workspace .ds workspace file. The location to which workspaces are saved is displayed in the iRecovery Stick options. By default, it is: C:\Users\\Documents\iRecovery\Cases

Does the iRecovery Stick collect all data?
Yes, all items belonging to a certain category of collected data are collected.

Can I upload the collected data to a new device?
You can only export graphic and multimedia files to their native format and upload them to another device manually.

How can I find specific items in the collected data?
You can use the search function. To use the search, after performing a collection, enter a word or a phrase in the search field in the top right corner of the window and click the search button or press Enter.

Can I export the data displayed in a grid format? Yes. To export data from grids, click Export to Microsoft Excel in the File menu or select data in the grid, click Copy in the right-click menu, and then paste the copied data to a Microsoft Excel file, email, or other document.

Can I export the collected files to their native format?
Yes, graphic and multimedia files can be exported to their native format. To export data to its native format, select a file and click Export or Export all in the right-click menu.

Can I resume working with the collected data after closing the program?
Yes, if you save data to a workspace, you can open it any time after closing the program.

Can I view the content of the collected data in the iRecovery Stick interface?
Yes, after a collection process is finished, you can select the type of data to be displayed on the Acquired Data pane and view its content.

What is the Extended View pane?
This pane allows viewing data in its original format.

What type of data can I view on the Extended View pane?
On the Extended View pane you can view data displayed as [BINARY DATA] in the RawData column of the Recovered Contacts Properties, Address Book Images, and Recovered Data categories of data.

How do I view data in its original format?
To view data in its original format, click BINARY DATA in the Recovered Contacts Properties, Address Book Images grid, or any grid in the Recovered Data category.

What is this BINARY DATA displayed in the Recovered Contacts Properties, Address Book Images, and Recovered Data?
This is collected/recovered data in a binary format.

What do I need the BINARY DATA for?
If some data was not parsed correctly, you can use the binary data view to view the data in a non parsed format.

Why are there no images in the Address Book Images of the Other Data category?
The images from a device address book cannot be viewed in their native format and are displayed only in binary format in the iRecovery Stick interface on the Extended View pane.

Collected Data Types:

What does the Messages category include?
This category includes collected SMS messages and iMessages.

What does the Contacts category include?
This category includes collected contacts and recovered contact properties.

What does the Call History category include?
This category includes collected records of incoming and outgoing calls.

What does the Graphics category include?
This category includes collected images.

What does the Organizer category include?
This category includes collected calendar data and notes.

What does the Multimedia category include?
This category includes collected audio and video files.

What does the Internet Data category include?
This category includes the following collected data:

  • Mail accounts stored on a device
  • YouTube bookmarks
  • Safari web-browser bookmarks
  • Safari web-browser suspended state
  • Safari web-browser history
  • Binary cookies for web-sites
What does the Recovered Data category include?
This category includes the following recovered data:
  • SMS history
  • iMessages
  • Notes
  • Call history
  • Contacts
  • Safari web-browser bookmarks
  • Calendar
  • Cell locations
  • Wi-Fi locations
What does the Tracking History category include?
This category includes collected history of device movements that can be viewed on a Google Earth map (if tracking was enabled on a device).

What does the Other Data category include?
This category includes the following collected data:
  • Device properties
  • Dynamic text
  • Address book images
  • Maps directions
  • Maps bookmarks
  • Maps history
  • Cell locations
  • Wi-Fi locations

Searching:

How do I use the search function?
To use the search, after performing a collection, enter a word or a phrase to search in the search field in the top right corner of the window and click the search button or press Enter.

How does the search work?
It searches for the defined words and phrases in collected data and file names and displays places where those words and phrases were found.

What does the Search Word List function do?
It uses a file with a list of words and phrases to perform a search.

How do I use the Search Word List function?
First of all you, need to create a text file with a list of phrases and words to search - one word or phrase for search per line (if you enter several words in a line, they will be interpreted as a phrase). Then click the Search Word List icon in the search filed, navigate to the file, and click Start Search.

Please note that the search is performed for every word/phrase in each entry or file name.

Bookmarks:

What are bookmarks?
The bookmarks are pointers to data stored in a workspace. They are used during investigations to mark and make notes for important items.

Do bookmarks change the collected data somehow?
No, they exist only in a workspace and do not affect any collected data.

Where can I view all bookmarks?
To view created bookmarks, click View Details under a device image on the collected data page and then click the Properties tab of the Details pane.

How can I view an item to which a bookmark points?
To view an item to which a bookmark points, select a bookmark on the Bookmarks tab of the Details pane and click View in the right-click or Manage menu or double-click a bookmark.

How can I create a bookmark?
To create a bookmark, right-click an item on the collected data page, select Add to Bookmarks, enter a description to a bookmark, and click Save.

How can I edit a bookmark?
To edit a bookmark, select a bookmark on the Bookmarks tab of the Details pane and then click Edit in the right-click or Manage menu.

How can I delete a bookmark?
To delete a bookmark, select a bookmark on the Bookmarks tab of the Details pane and then click Delete in the right-click or Manage menu or press Delete.

Validation:

What do I need the validation for?
You can perform a validation to make sure that data in a workspace was not altered.

How does the validation work?
It compares a hash file of a workspace after the collection and a hash file of a workspace at the moment of validation. Has values are mathmatical computations that act as digial fingerprints. If the hash values match, no data has changed.

Options:

What do I need logs for?
The logs are used by the Paraben support to help you if some problems in work of the program occur.

What is plug-in log?
A plug-in log is a log of the collection based on the plug-in activity.

What is a serial log?
A serial log is a log of all events that happened in the iRecovery Stick interface during one program session.

Workspace:

What do I need a workspace file for?
This file stores the collected data so that you can any moment resume working with it.

Can I move a file to another place?
Yes, a workspace can be copied and moved.

How can I open another workspace?
To open another workspace, click Open Workspace in the File menu.

Can I collect data from different devices to one workspace?
No, you can collect data from one device only to one workspace.

What other means can I use to analyze collected data?
You can use Parabenís Device Seizure. To open the collected data in Device Seizure, click Open in Device Seizure in the Fine menu (if you have Device Seizure installed on your computer).

I need to perform a deeper analysis of the collected data. What can I do?
You can use Parabenís Device Seizure. Device Seizure will allow you to view all data collected and not just those portions parsed out in the iRecovery Stick. To open the collected data in Device Seizure, click Open in Device Seizure in the Fine menu (if you have Device Seizure installed on your computer).

File Menu:

What does the Open Workspace menu item do?
It allows you to select a previously saved workspace for opening.

What does the Save As menu item do?
It allows you to save a workspace with collected data to a specified location and define its name.

What does the Start Recovery menu item do?
It allows you to start a collection of data from a device.

What does the Start Import menu item do?
It allows you to start import of data from an iTunes backup file.

What does the Export to Microsoft Excel menu item do?
It allows exporting all collected text data to a Microsoft Excel file.

Do I need Microsoft Excel to be installed to perform exporting to Microsoft Excel?
Yes, Microsoft Excel must be installed to export data to it.

What does the Open in Device Seizure menu item do?
It allows you to open and investigate collected data in Parabenís Device Seizure if it is installed on your computer.

What does the Exit menu item do?
This menu item closes the program.

View Menu:

What does the Properties menu item do?
It opens a pane that displays the properties of the investigated device.

What does the Bookmarks menu item do?
It opens a pane that displays the list of existing bookmarks in a workspace.

What does the Acquisition Details menu item do?
It opens a pane that displays the details on the collection process.

What does the Extended View menu item do?
It opens a pane that displays the data that was not parsed or data that was partially recovered in a text format.

What does the Search Results menu item do?
It opens a pane that displays the history of performed searches.

Tools Menu:

What does the Options menu item do?
It opens the iRecovery Stick options window for the defining the types of logs to be created and to which locations logs and workspaces will be saved.

What does the Validate Workspace menu item do?
It allows you to perform the validation of a workspace.

What does the Check for Updates menu item do?
It allows you to perform a check for available iRecovery Stick updates.

Help Menu:

What does the Help menu item do?
It opens the iRecovery Stick help file.

What does the About menu item do?
It displays the information on your version of iRecovery Stick.

What does the About Qt menu item do?
It displays the information on the programming platform on which the iRecovery Stick was developed.

Properties:

What information is displayed in the Program timestamp field?
This field displays the information on the time when a collection was performed.

What information is displayed in the Manufacturer field?
This field displays the information on the manufacturer of a device.

What information is displayed in the Device model field?
This field displays the information on a device model.

What information is displayed in the Product Version field?
This field displays the information on the device OS version.

What information is displayed in the Build Version field?
This field displays the information on the device OS build version.

What information is displayed in the Model Number field?
This field displays the information on the number of a device model.

What information is displayed in the Device Name field?
This field displays the information on the name of a device (a custom name given to a device by a user).

What information is displayed in the Model Name field?
This field displays the information on the full name of a device model.

What information is displayed in the Serial Number field?
This field displays the information on the serial number of a device.

What information is displayed in the Modem Firmware field?
This field displays the information on the version of a device modem firmware.

What information is displayed in the ICCID field?
This field displays the information on the integrated circuit card identifier of a device SIM card.

What information is displayed in the IMEI field?
This field displays the information on the device international mobile station equipment identity.

What information is displayed in the IMSI field?
This field displays the information on the international mobile subscriber identity of a device SIM card.

What information is displayed in the WiFi Address field?
This field displays the information on the device Wi-Fi address.

What information is displayed in the Bluetooth Address field?
This field displays the information on the device Bluetooth address.

Supported Operating Systems: Windows XP, Windows Vista, Windows 7