My 19 month old daughter loves to watch videos on my iPhone. She knows right where to go in the Photos app — either in the Camera Roll folder to watch videos we might have recently captured, or in the “Videos” folder containing videos from the computer. Content in the Videos folder is safe from deletion, but not content in the Camera Roll. Occasionally she gets to tapping on the screen and starts the process of sending a video to someone via email (inevitably to someone in my contact list that I haven’t contacted in years), or accidentally deleting a video. More than once she has deleted a video I wished to keep.
I’ve seen “undelete” iPhone apps on the web, but no free ones. In my case, I frequently charge/sync my iPhone with my computer, but only occasionally download the Camera Roll photos and videos to an image or video editor. Figuring the video must be on my computer as part of a recent iPhone backup. I went looking for them.
Here is a process you can use to find videos (or photos) deleted from an iPhone that have been backed up but not officially imported into iPhoto or whatever video/image editor you use. As a developer, I spend at least 50% of my time in a terminal (and the other 50% in a text editor it seems), so while doing it this way makes perfect sense to me, this process is not for everyone.
The process might also be different for someone on a different computer than mine (MacBook Pro running Leopard). Of course, I cannot be held responsible if someone accidentally does any harm to their data, yadda, yadda, yadda.
Locating backup files
iPhone backup files are located in
~/Library/Application Support/MobileSync/Backup/<identifier>
Where “~” represents the current user’s home directory (/Users/doug for me) and <identifier> is a directory named as a string of characters and numbers, looking something like “e22974ecba2e148634027a65676cf886542eb4f3”. These are actually files from the phone, named according to some standard the iPhone or backup process follows that I have not investigated. How or why they are named like they are is not important to this process.
If you have more than one <identifier> type directory, for instance you might have an iPhone and an iPod Touch, there is an Info.plist file in each directory that contains information about the contents of that directory. If one has the Apple developer tools installed, one can use the Property List Editor to view the Info.plist file. The file can be opened in a text editor, and although it looks like a jumbled mess, you can still figure out which device the directory is tied to.
Find the correct files
The files in that directory are named with a similar string of characters and numbers, so the file name is of no help in identifying which files are video files. In a terminal, the “grep” command can be used to find which files have the string “quicktime” embedded in them, which identifies them as video files.
$ grep quicktime * Binary file 17f644e4b51c4066a4bed67cf280f45af9db1ab3 matches Binary file 50715d41d5d681e6cffc9b9a9743f138f1a59de5 matches Binary file 81c24084feb7976bde1e04957dd2402064055e12 matches Binary file afd7337a0f23fc1ac143ba66491a2b67d0edb90a matches Binary file d1f062e2da26192a6625d968274bfda8d07821e4 matches Binary file e22974ecba2e148634027a65676cf886542eb4f3 matches
Each file will have to be opened and viewed to determine if it’s the video that was accidentally deleted. The files can be opened with Quicktime. Since we’re already at the command line, let’s use the “open” command:
open -a "Quicktime Player" 17f644e4b51c4066a4bed67cf280f45af9db1ab3
Open each one until you find the one you are looking for. Once you find it, save it somewhere else on your system and it can then be imported into iPhoto or any other image/video application.
Photos too!
Incidentally, to look for photos, grep for “Back Camera” or “Front Camera”:
$ grep "Back Camera" * Binary file 230d32dc1fee6d54914d7ff58f4d4f9c7f27e533 matches Binary file 2a041bfd473c7a136dff7b42e616c84344d7f27a matches Binary file 4c7b36a43ec5836ff62a22ec2cd2a21ec8df7400 matches
and open them in Preview to view them:
open -a Preview 230d32dc1fee6d54914d7ff58f4d4f9c7f27e533
Sorry for the geekiness of this process. I mainly documented the process for myself, but hopefully someone else will find the information useful.
My 19 month old son just deleted a video of himself but I have not synced my phone since the video was taken, I’m screwed right? I did however send the video mms, when I tried re-saving it from mms it’s much smaller and lower quality, anyway to get the original back from a mms?
Thanks! Worked like a charm, although i just sorted by file size and realized the largest one is my vid!
@Ashley Sorry I don’t think there is any way to get back the original.
I’m following the instructions. Actually, while the grep * works, sorting them by size in the finder (on a Mac) is indeed faster. However, I cannot get Quicktime to open the raw data files. Every time I either launch Quicktime on the command line with your syntax or try to Open With using right click, I get the error: “The document “361a8efb51d0221d65653cd865ef9e83e48a4ff2” could not be opened. QuickTime Player cannot open files in the “data” format.”
Is there any help? I’m using OS v 10.6.8
@Robine That file must not be a video file. I had similar results with several large files in my backup directory. For any files where the “grep” command found a match, Quicktime plays them as expected.
Maybe perform the grep command large files until you find one that matches, then attempt to open it.
grep quicktime <big ugly file name>
Thank you Doug. Unfortunately these did match the grep command. I can see the jpgs in the directory as thumbnails in the finder but not the ones that match the Quicktime grep command. I was wondering if something might have changed with Quicktime or whether it only recognizes .mov file formats (or similar) now. Have you tried it recently? I noticed that your column is from a while back. Thanks!
Note: Apple seems to have changed the data format for media backed up to the computer. This method of recovering deleted photos from a previous backup seems to no longer work. Video files are no longer detectable with a simple ‘grep’ command.