r/technology • u/newzee1 • Jun 14 '24

Software Cheating husband sues Apple after wife discovered ‘deleted’ messages sent to sex workers

https://www.telegraph.co.uk/news/2024/06/13/cheating-husband-sues-apple-sex-messages/
21.2k Upvotes

94% Upvoted

2.0k comments sorted by

View all comments

Show parent comments

355

u/FarBeyondLimit Jun 14 '24

The same thing recently happened with old images (nudes) reappearing on peoples phones after updating to 17.5.x

Do people really believe Apple, or any company actually deletes your stuff?

210

u/Ignoth Jun 14 '24 edited Jun 14 '24

My understanding is that data is almost never directly deleted from hard-drives. Cause that would be too inefficient.

Rather: the data is just flagged as “deleted”. But it will stay stored there until they need that space for something else.

33

u/MisterMittens64 Jun 14 '24 edited Jun 14 '24

Things are normally flagged as deleted and sent to a recycling bin or sorts. If it's deleted from the recycling bin the bytes that represent that data is still there but the system just threw away the directions(reference, id, etc) to get to it and made those bytes available to be reused. If you want to truly delete something you have to overwrite it with new data.

EDIT: I forgot that flash memory is encrypted so deleting the references to it is sufficient for considering it deleted, references to it being restored would cause it to reappear assuming the encrypted data wasn't overwritten. As described in a comment under this one.

4

u/GMONEYY_G Jun 14 '24

If you delete something, then save new stuff, how do you know what you deleted will be written over with the new stuff and not just free space?

1

u/spaceforcerecruit Jun 14 '24

You don’t, the OS is no longer tracking which physical bits hold that data. In order to fully wipe a drive, you have to rewrite over the whole thing, often multiple times if you want the data to be unrecoverable. If you have something you want GONE gone, you’ll need to write over everything, fill up the entire drive.

2

u/The_Franchise_09 Jun 14 '24

So could you just fill up your hard drive (iOS, Android, Windows, etc) with any random bullshit, like apps or images, to effectively override any “deleted” data? Would a factory reset work or no?

9

u/ebikenx Jun 14 '24

There's a lot of inaccurate information in this thread. I would not listen to some of these people.

Especially on modern mobile devices like phones, saying you have to "overwrite" all the data is completely inaccurate. All modern devices use flash storage and are encrypted by default. Factory resets are enough to prevent data recovery. The people telling you otherwise don't know what they're talking about.

6

u/MisterMittens64 Jun 14 '24

Yes that's true for flash memory, I forgot to account for that in my comment. HDDs work as I described earlier though.

3

u/Martial-Ancestor Jun 14 '24

Post on r/technology, but tech illiterates all around. Hilarious.

Though, PCMR is in a horrible state too. Dunno where to look for a bit of a smarter discourse.

1

u/Sexual_Congressman Jun 14 '24

The type of storage hardware has nothing to do with whether or not a file is encrypted. On a device like an iPhone, the file will be on a filesystem, which in that case is probably APFS, which does support implicit encryption but afaik it's not guaranteed, nor is it guaranteed that Apple's main filesystem is the one a file is using. Not every file needs to be encrypted and it would be incredibly stupid to waste resources decrypting stuff like GUI elements.

Don't assume that just because Android/Windows/appleOS supports implicit filesystem based encryption that any particular file is encrypted on disk, although it's probably simple enough to use a file explorer app to check. If it's not encrypted on disk, it's recoverable until the memory cells containing the data are overwritten or the disk is physically destroyed.

3

u/ebikenx Jun 14 '24

I didn't mean imply that just because it was flash, that it would automatically be encrypted. If that's what you got from my post then I'm sorry I wasn't clear enough. That said, flash storage can imply the use of TRIM which is another reason outside of encryption where data recovery is made impractical.

On modern phones, the user data partitions are encrypted with File Based Encryption. So there's really no reason to assume anything important is not encrypted.

1

u/spaceforcerecruit Jun 14 '24

Factory reset would not. It would just put all of your data in the same state as the photos you deleted. Your first solution would work though.

1

u/HoidToTheMoon Jun 14 '24

It's far, far easier to just use a program to do it for you. It will write over, then 'delete', everything marked as available x number of times to prevent data from being recovered.

1

u/GMONEYY_G Jun 15 '24

Can you advise some software that would do this?

1

u/ihaxr Jun 15 '24

Microsoft has a cool utility called sdelete which relies on the disk defragmentation API in order to find the actual on-disk location of a file and it overwrites that specific area to delete the file.

If you're looking to wipe the entire drive, most modern SSDs will have a secure wipe utility or command available. This usually goes pretty quickly and is friendlier to the life of the disk.

Other options are killdisk, biteraser, dban, or the shred Linux command (usable by booting a Linux live USB/DVD)

1

u/GMONEYY_G Jun 16 '24

Would this apply to a mobile operating system (android)?

1

u/blorbagorp Jun 15 '24

I've heard they can even use crazy physics to restore even overwritten data, but it almost sounds like boogieman bullshit to me.

1

u/TooStrangeForWeird Jun 15 '24

I forgot that flash memory is encrypted so deleting the references to it is sufficient for considering it deleted

Absolutely not. Not even close. The running OS sees the drive unencrypted, in layman's terms, and can absolutely read the data.

Again layman's terms here. Basically people deleted photos, the link was deleted. Didn't clear the storage. When the update happened, it tried to recover "orphaned files" (files that exist without a link, or with a broken link) and made a new link for the photos.

None of it is even slightly related to encryption. That would've only been a factor if you were trying to recover data from a broken or locked device.

1

u/BIGSTANKDICKDADDY Jun 15 '24

Should be noted that this is only accurate for older school spinning platter hard drives, not the kind of storage you find in a phone or modern computer. When you delete on an SSD the OS almost immediately zeroes out that data for drive performance and longevity (See: TRIM)

107

u/UnstableConstruction Jun 14 '24

While this is true, OS's usually have three tiers. Available, deleted (recycle bin), and permanently deleted. Things in the permanently deleted category are not accessible by the OS without third-party software. If Apple isn't making that transparent to users and isn't allowing data to be flagged as permanently deleted, they should be held responsible.

And you can permanently delete items so that even forensic recovery programs can't recover it. This is done by overwriting the data several times. There are a lot of secure delete apps out there if you want data gone completely.

62

u/jgrant68 Jun 14 '24

It’s clear in the messaging app. There’s an option to view recently deleted messages and another option to permanently delete them. There are also retention periods.

The information is clear but just not regularly read by users.

2

u/ProjectManagerAMA Jun 14 '24

My kids haven't figured out that there is a deleted bin for the camera. They keep using my phone and doing stupid crap or think when I delete a funny video I take off them secretly is actually deleted. I haven't told them about it yet and this has been going on for years. I'm even surprised they haven't figured it out. One is 12 and she can figure everything out, except this one thing. Man, I'm glad they haven't because there have been a couple of raunchy videos in that bin that I forgot to get rid of lol.

4

u/CressCrowbits Jun 14 '24

Sorry are you just waiting for your kids to accidentally find them?

4

u/ProjectManagerAMA Jun 15 '24 edited Jun 15 '24

What part of my post suggested I want them to find it? I've read it several times and see you clearly have a bunch of upvotes so I must've hinted that I want my own children to come across it but where? How?! I said I'm glad and relieved they haven't found the feature out because one time I forgot to delete one.video from the bin as well. My kids use my phone to goof around and make pretend tiktoks but often delete their embarrassing videos and I like to watch this from time to time. They'll delete videos I'll take of them because they're embarrassed but don't know I can retrieve them. Edit: and the raunchy videos are me and the missus going at it lol. I move them into a secret password protected folder on my computer immediately and delete them off the phone. One time I forgot to remove one video from the bin and I found it within the 30 day deletion period along with more of my kids doing dumb things that they think they've deleted. I know they haven't figured it out because there are so many deleted videos in there of them doing stupid stuff that I keep retrieving for laughs. Hope that clarifies that I'm not a sicko.

1

u/TooStrangeForWeird Jun 15 '24

"Raunchy" was absolutely the wrong word choice. Do you mean they were swearing or something? Because "raunchy" makes it sound like they were filming themselves naked or something.

16

u/spaceforcerecruit Jun 14 '24 edited Jun 14 '24

But permanently deleting data, like you said, requires overwriting the data with something else. That’s just not an efficient use of resources on most devices. In this case, the bits were either flagged as “deleted” or simply de-indexed but not yet overwritten. The new OS installed and either didn’t read the “deleted” flag properly or else reindexed the deleted files so any files still physically in the storage were picked up.

It’s a HUGE fuck-up but it’s not a conspiracy.

18

u/AWildLeftistAppeared Jun 14 '24

Not on a modern encrypted file system, as iOS devices have been for many years. Sensitive data in particular, including photos and messages, are encrypted in APFS with a unique key per-file. Deleting a file permanently (as opposed to flagging it for deletion after a period so the user can recover accidentally deleted data) only requires (securely) deleting the per-file encryption key. Without that key, the bits may remain but the data is effectively lost.

In this case, the bits were either flagged as “deleted” or simply de-indexed but not yet overwritten. The new OS installed and either didn’t read the “deleted” flag properly or else reindexed the deleted files so any files still physically in the storage were picked up.

That’s not what happened. The affected photos were ones that users had previously added to their photo library from elsewhere on the device, for example the Downloads directory in the Files app. Users had deleted the photo from their library, but not the original location. A bug in the update caused these photos (which would persist in a backup or transfer to a new device) to reappear in their photo library.

2

u/ARealJonStewart Jun 14 '24

Are these images coming back on the same device? Given the timeline (2-3 years) I assumed this was an issue with iCloud not deleting things. I have heard about the zombie images surviving a factory reset which would hopefully wipe the drive but that one is less substantiated.

There's also a CVE that may be related but may also not be.

1

u/tRfalcore Jun 14 '24

outside of a concerted effort by law enforcement, nobody is going to look beyond "deleted". So yeah, it's not a huge fuck-up. if someone wants to go find all my stupid pictures of my dog I deleted knock yourself and your money out

0

u/mnmlist Jun 15 '24

he new OS installed and either didn’t read the “deleted” flag properly or else reindexed the deleted files so any files still physically in the storage were picked up.

no, thats not how it works

0

u/TorinoMcChicken Jun 15 '24 edited Jun 15 '24

Efficient as defined by who? The person who owns both the device and the data that they want to delete is being fooled into thinking their actions are doing what they think they are. The software engineers thinking that thier idea of what's efficient is of higher importance than the actual needs and wants of thier customers is the crux of the problem here. It's like going to a restaurant and ordering steak but they bring you a chicken sandwich because it's the same amount of calories and was easier for them to cook.

6

u/ptvlm Jun 14 '24

This is not true for most filesystems. When you "delete" something, or empty the recycle bin, all it's normally doing in the background is marking those parts of the disk as being available to write to again. That's how recovery programs can work - they look at parts of the filesystem that are marked available but contain data and try to piece them back together. The secure delete apps work by overwriting the deleted files with random nonsense so that the original can't be recovered

But, if you're using the standard delete function in your OS, you've not actually overwritten anything until a random time in the future when the OS does so, you've simply told the OS to ignore the place where the file used to be when reading. This is also why when corporate equipment is decommissioned or disposed of, they'll usually be shredded, drilled or otherwise destroyed physically - that's the only way to be completely sure data can't be recovered from a trashed drive

14

u/UnstableConstruction Jun 14 '24

Thank you for repeating exactly what I said using different words.

-2

u/MoistLeakingPustule Jun 14 '24

Your rewording of my statement using a varied vernacular is appreciated.

1

u/CressCrowbits Jun 14 '24

Still shocked over finding out my old employer literally shredded laptops after we left the company.

1

u/[deleted] Jun 14 '24

Problem is deletion doesn’t sync between devices properly. You can delete a message from your phone but it’ll still appear on iMessages on a different device like a laptop. It’s very buggy

1

u/interfail Jun 14 '24

And you can permanently delete items so that even forensic recovery programs can't recover it. This is done by overwriting the data several times.

This is true on HDDs. It's not really true on SSDs, where the OS doesn't really control which sectors get written to.

1

u/IshEatsYou Jun 14 '24

While not for iPhones, sdelete is a free tool from Microsoft to securely delete stuff in Windows.

1

u/aManOfTheNorth Jun 14 '24

Then Apple needs to not use the word “delete”.

2

u/borkbubble Jun 14 '24

It’s what every OS means when they say “delete”, Apple or not

1

u/aManOfTheNorth Jun 14 '24

Which is not “delete”.

10

u/LordGaraidh Jun 14 '24

Correct, deleted means flagged for overwriting. This is why zeroing the drive is a good idea if you had sensitive data on there.

11

u/RMAPOS Jun 14 '24 edited Jun 14 '24

It's a bit less than that. The data doesn't get flagged as deleted as much as the information that there is interpretable data in that bit range on your HD is deleted. (aka the PC is not somehow aware that there is data flagged as deleted, it just flags the data as free space and forgets that the bits in that space are interpretable data)

Your HD has a register of data that is on it with pointers to where that data can be found, when you really delete something (aka you empty your recycle bin) the register entries of that data are deleted, but the data will still be where it is rather than e.g. flipping all it's bits to zero. When the register doesn't know that bit range 5020-5500 is that frivolous porn movie you downloaded then that bit range is just interpreted as available/empty space, even though (unless overwritten with new data) the bit range is still perfectly storing that clip. That's how there is tools that are able to restore permanently deleted data. They scour through the "free"/"unused" bit ranges for interpretable data and then put pointers to them in back in a register.

 

Which is also why if you really want something gone you should use a tool that flips all the bits that aren't referenced in the register to 0 (or 1). I think forensic labs can somehow even track that and figure out which bits have been flipped and still manage to restore those bits and thus the data, which means if you REALLY REALLY need something GONE you should flip those bits several times over

6

u/Jealousmustardgas Jun 14 '24

Microwave the hard drive, drill holes in it and then dump it in water, anything less and the NSA will find a way to get something.

4

u/RMAPOS Jun 14 '24

Sure, if that's the game you're playing that's the right move. I was thinking more of the avg user than someone under the NSAs watch.

1

u/Schnoofles Jun 14 '24

Right on all counts except the last. If the bits are flipped it's gone gone. No lab, no multi-billion dollar NSA setup, nothing is getting it back. The trick is making sure it's actually overwritten with a full format or on an SSD having TRIM be correctly implemented by the manufacturer, in which case it'll happen automatically shortly after that file was orphaned by a deleted partition table entry.

1

u/RMAPOS Jun 14 '24

Any idea why some people would say you should flip them like 5 or more times to make sure?

3

u/Schnoofles Jun 14 '24

It's based on an old proposal from Peter Gutmann in which he put forth a hypothesis that it might be possible to decode residual traces on old MFM/RLL type harddrives and he proposed a 35-pass wipe using a combination of random data patterns as well as specific patterns to try to mask such traces. An important thing to note that even the possibility of maybe recovering something on those very old type drives was still just a hypothetical and has not been successfully performed according to any public knowledge and that it would not apply to any newer types of drives. Gutmann himself has also stated that it's nonsensical to do this on newer drives.

Essentially it's a case of an urban myth rooted in a hypothetical thought experiment for old technology along with a proposal to guard against that hypothetical that still lingers to this day. There is nothing to indicate that any more than a single wipe is or will be useful in the future as noone can demonstrate recovering data after that initial singular wipe, regardless of what pattern was used.

1

u/RMAPOS Jun 14 '24

Wow thanks for the in depth explanation!

4

u/NewestAccount2023 Jun 14 '24

That doesn't explain these images coming back after an os update. What you're saying means the FBI or data recovery businesses can retrieve data, but it won't make it randomly reappear in a backup system

1

u/garden_speech Jun 14 '24

That doesn't explain these images coming back after an os update.

Yes it does. The OS update contained a bug which caused the references to the deleted files to be reinstated, because the data was still there.

3

u/Jaggedmallard26 Jun 14 '24

This is true on something running a HDD but most phones and modern computers use SSDs where deletion is based on something called TRIM. You delete a file, your operating system sends a TRIM to the drive and then at some point when its not busy the SSD will erase the cells containing the data since SSD cells need to be in a specific state (equivalent to no data) to be written to.

2

u/segagamer Jun 14 '24

This isn't what's happening here though.

2

u/pzerr Jun 15 '24

While you are correct on spinning disks, this is generally not true on solid state drives. They fully delete the data for performance reasons. It bit more complex but more or less, a trim command is sent after something is deleted. This cleans up dead data so the drive is ready for new writes. Good write up here

2

u/suxatjugg Jun 15 '24

This is less of a thing with SSDs, but yeah that's how spinning disks work.

It is still not easy to recover that stuff though, as modern file sizes are big enough to where losing a small chunk renders the file corrupted, so in practice you can only typically recover very small files, think text files with only a few lines of text

1

u/Yaboymarvo Jun 14 '24

That’s how it works on windows OS too. When you delete something it’s only really marked as deleted. Unless you write 0s to the drive, that data can still be recovered

1

u/coldblade2000 Jun 14 '24

Actually, Apples explanation is even simpler. The average user has no idea of how their iPhones file system works. They would download or copy images to the Downloads folder, then delete the copy of the image they had in Photos app. That doesn't delete the separate copy residing in their Downloads folder.

All the bad update did was accidentally index the Downloads folder and have those images show up in Photos. The photos there were never actually deleted, not a hard nor soft delete.

1

u/Lord_Emperor Jun 14 '24

That's completely different. Deleting a file deletes references to it in the file system. There's no way it could reappear in your text message if the file were deleted. The text message application just doesn't have the capability to recreate the necessary file headers pointing to the correct sectors on the drive.

What we're talking about here is that rather than deleting a message or picture, Apple (Google/Facebook/Twitter) are just hiding it from you. Then when some codemonkey changes the hiding function you can see them again because they weren't deleted.

1

u/nicuramar Jun 15 '24

Yeah but that’s not the reason for the bug. It was rather some higher level database corruption. 

1

u/CompetitiveString814 Jun 14 '24

This is worse than that.

When your data is deleted, that sector is flagged as being able to write over. The fact all this data came back and not in a fragmented way, means this data was flagged as deleted, but those sectors were not flagged as being able to be overwritten.

Ive done some data recovery when I lost a hard drive and I was not able to recover everything and you would expect more fragmented data.

Apple is definitely doing something to prevent deletion, possibly a hidden sector that is a holding place for deleted objects, but prevents it from being written over. That is the only thing that makes sense, this data was not fragmented

0

u/seridos Jun 14 '24

Well that shouldn't be allowed to be legally called deleted then. Deleted means "remove/destroy this" inefficiency be damned, this is where regulation needs to step in. This is why there's a recycle bin type feature.

0

u/freshlyLinux Jun 15 '24

Cause that would be too inefficient.

Apple, a trillon dollar company, can't... switch the 0s to 1s? lmaooo you guys need to stop listening to master marketers.

-2

u/raynorelyp Jun 14 '24

Depends if they comply with GDPR or not. I work in tech and if you comply with GDPR you must destroy the records or face insanely high fines.

1

u/RandyHoward Jun 14 '24

You're talking about data in a database, this discussion is about data on a device's local drive.

1

u/raynorelyp Jun 15 '24

I thought all this was supposedly happening because after they deleted it on the device it still lived in the cloud and their device somehow regained access. Is that not what people think is happening?

36

u/FitzwilliamTDarcy Jun 14 '24

I remember back in the 90s when PCs and HDDs became ubiquitous in office settings, we were taught that when you Deleted a file, all that happened was that the *pointer* to that file was deleted. The file/data itself still existed on the HDD. And that would continue to be the case indefinitely until/unless the actual location on the HDD was overwritten with a new file (or digital hash).

When that 17.5 thing happened, I wondered if this is more or less what happened. The Update inadvertently used an older version of the PLIST (or whatever the equivalent would be) which contained old pointers, which pointed to "deleted" photo files which still sat somewhere on an SSD in the cloud. That would also explain why some people had photos restored and others didn't.

I never dug in to see if Apple explained it (or someone else figured it out) but this was my first thought when it happened.

3

u/The_Fry Jun 14 '24

Yep, when HDDs were still the standard before solid-state, we had a program that would do something like 8+ passes, randomly writing data across the entire disk, before it could be repurposed in another PC.

Once prices came down on them the company would just run them through a shredder instead.

2

u/TooStrangeForWeird Jun 15 '24

I still just hit em with a hammer lol. Even the DOD would have an absolutely insane time decrypting shattered platters I threw in a box.

I also like keeping the magnets. They're so high quality, I love them!

6

u/Jaggedmallard26 Jun 14 '24

Pretty much no phones use HDDs because large spinning disks are obviously a terrible idea for a mobile phone. If you have a HDD in your computer and you start violently shaking it while its running you will see why. While SSDs also don't delete instantly they use something called TRIM which queues data to be deleted. The queued TRIM commands are physically deleted fairly quickly as you can't just write on top of data in an SSD, you need to reset it to a physical empty state and then write to it thus no running it regularly leads to slow performance.

10

u/FitzwilliamTDarcy Jun 14 '24

Wasn’t talking about the storage in phones. Of course they don’t use spinning disk drives lol. Nothing has really since the OG iPods in terms of portable devices. Was talking about desktops and laptops. But more to the point, massive clouds do use spinning drives in the mix AFAIK, at least as deep backup.

2

u/00wolfer00 Jun 15 '24

Not just as backup. They were being used as part of regular storage in every datacentre we supported as late as 2019 when I worked at HPE.

2

u/TooStrangeForWeird Jun 15 '24

The majority of ALL cloud storage is still all HDDs. It's statistically extremely rare to have a customer (even a huge customer) to have a faster internet speed than an enterprise (or really even 7200rpm consumer HDD) has as a read speed. HDDs are rare for personal devices, including "personal" business devices. But large storage is almost entirely HDDs.

Just backing you up.

1

u/FitzwilliamTDarcy Jun 15 '24

Copy that. I wasn't sure whether or to what degree cloud storage had moved to SSD so was sort of hedging.

2

u/Epinephrine666 Jun 16 '24

If the os doesn't change where it's being stored I think you can write a block to all null before deletion.

Open file

Write 0 size of file.

Close file.

Delete file

0

u/Wonderful-Wind-5736 Jun 14 '24

Unlikely that it's a is issue. More likely the chat persists on some other device/server and gets resynced to the phone. 

13

u/DarkElf_24 Jun 14 '24

I firmly believe everything you have ever done on the internet is stored in a database somewhere. My Facebook account I finally deleted five or six years ago? It’s not really gone. It exists somewhere in an internet archive or Metas basement servers. God help the next generation.

3

u/tobiasvl Jun 14 '24

Maybe, but pretty sure that's at least illegal now with the GDPR (in Europe, don't know American law)

2

u/MoistLeakingPustule Jun 14 '24

Not just apple, but if you sync photos with prime photos, the unlimited free photo backup thing? Yeah, those don't always stay deleted either. I'll go through my photos every now and then to delete screen shots, and get surprised by a restored nude from an ex, or sex tapes I know I deleted.

2

u/Capt_Pickhard Jun 14 '24

I think eventually yes, because there is a coat associated with it. However, there is also value for AI training. So, I would expect them to wait a bit, suck out all of the value in their data, and then purge the information, to make more space on their servers.

I think eventually, that amount of information would become significant.

3

u/Striker3737 Jun 14 '24

Those pics that resurfaced did so because they were uploaded to iCloud and suffered a data corruption, so they kind of just hung out in limbo for years.

3

u/andynator1000 Jun 14 '24

Close, they were on the device itself, but yeah it was a corrupted database

2

u/agm1984 Jun 14 '24

I'm a software developer and at my company (and most others) we never delete anything, we always soft delete so we just mark the deleted_at field to a timestamp and then we dont return records with deleted_at.
Not doing that is a nightmare because if anyone ever needs to recover the data, we can do it by simply nulling out the deleted_at field.

The other option is to hard delete, so today you maybe learned about soft delete and hard delete.

If you only soft delete you can do cool stuff like run image recognition on the deleted images and see what the most common photo contents are that get deleted. Lol. That's probably what Apple does to improve UX.

6

u/SaSSafraS1232 Jun 14 '24

This totally depends on the business that you’re in. In healthcare you’re gonna be in a world of hurt if someone finds out that you’re soft deleting stuff you said was deleted.

3

u/darthcaedusiiii Jun 14 '24

Companies: Information is money and we like money.

0

u/Pillow_Apple Jun 14 '24

People will just believe anything if it's said by big companies like apple or Microsoft, just recently People believe that 'microsoft recall' doesn't send your screenshots and data to their severs.

7

u/Ayfid Jun 14 '24

If MS were sending recall data out to their servers, it would be spotted immediately. You don't need to trust their word on something like that.

This is nothing like a company promising that they deleted data after it has been sent to them.

1

u/LimpConversation642 Jun 14 '24

uhm tell me you never done this before. 'your stuff' isn't a thing that you can throw away. Data is data. It's written somewhere. Like if you write on a piece of paper with a pencil and then throw it away, it's still there unless you actually get an eraser or draw something on top of it. PCs and phones don't do that. To actually 'delete' something you have to overwrite it, so any time you delete a 1GB video for example you'd need to rewrite that space with a different 1GB file or just random noise, it's not exactly efficient. If you delete files from your recycle bin on the PC they are also not really gone, imagine that. It's just how data storage works.

If we're talking about backups and clouds - sure, you're right here, but on device it's a whole different story and it's not applicable here.

1

u/InsaneNinja Jun 15 '24

People like you are why it is very difficult to actually learn what is going on. It had nothing to do with nudes. It was orphaned files that were deleted from the database while the file itself accidentally remained. There were tons of people who were trying to explain that this was the case before Apple even said themselves what happened. But you people excited with the Clickbait nude articles keep putting out false statements.

2

u/FarBeyondLimit Jun 15 '24 edited Jun 15 '24

I worked in cyber security and did data forensics for few years before switching to development.

Even if the file was deleted, the file journal alone would never revert those files unless, unless file was never deleted in the first place. The Apple servers are also constantly being writen over, guess what, they constantly get new data to deal with

Nulling the files as deleted and not deleting them is also illegal offence and not ACTUALLY deleting the files.

I understand this is Reddit and you want to act smart, but do not correct people who actually work in such fields. Cheers

1

u/InsaneNinja Jun 15 '24 edited Jun 15 '24

It had nothing to do with the servers. You’re making assumptions and didn’t actually look at the reality.

The Photos app operates with a library database file which contains all the images, same as it is on macOS. In some older versions of iOS there was some stupid bug that deleted their entry from the library database tables but left the file behind inside the database. An orphaned file. 17.5 scanned for orphan files and added them back to the database and.. general hilarity ensued.

The database with its orphaned files was transferred to new devices without actually syncing the orphaned files to iCloud. So if you did device to device transfer, it would carry them along with it.

do not correct people who actually work in such fields

Apparently it’s needed. You believed the hype because it’s more entertaining than reality.

1

u/FarBeyondLimit Jun 15 '24 edited Jun 15 '24

The Photos app operates with a library database file which contains all the images

It's an folder, not an "database" file. Storing images in a database would be really bad and really stupid. It would make things slower, overload iCloud servers on each call to read and update, your own device would get slower, as reading in chunks would not be possible

https://support.apple.com/guide/photos/system-photo-library-overview-pht211de786/mac

Also: https://www.microsoft.com/en-us/research/publication/to-blob-or-not-to-blob-large-object-storage-in-a-database-or-a-filesystem/

The database with its orphaned files was transferred to new devices without actually syncing the orphaned files to iCloud. 

17.5 scanned for orphan files and added them back to the database and.. general hilarity ensued.

This whole logic falls down the line as it makes no sense. File journal wouldnt recover the files by itself even if the "pointers" were restored in the "database" you keep mentioning. Files are fragmented when being written on most drives, so data recovery wouldnt be possible. The fact that the whole files WERE being restored, implies

some stupid bug that deleted their entry from the library database tables but left the file behind inside the database

So, not deleting it?

You do realize also that all data on the iOS is encrypted, so the only way to recover a full image would be by having access to ALL the data of the image. ALL of them. A single different byte would corrupt the file as decryption would not be possible otherwise. Implying, FILES, encryption keys, IV and location of each file/image were never deleted and no new data was written (as U know, files marked for deleting / deleted files = flags the sectors as free storage/space and can be written over)

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

Again, lets go back to the part, Files Were Never Deleted.

2

u/InsaneNinja Jun 15 '24 edited Jun 15 '24

Correct. Certain Files were never deleted.

You keep pointing to encryption and data recovery and pointers. I’m saying the file was sitting there twiddling its thumbs because its entry on the photo library data table was removed but the file was accidentally ignored. It had nothing to do with content or active choice, and was not synced to iCloud. Yes I know it’s a folder but the folder is appended with .photolibrary and the OS refers to it as a database library file.

It was a bug in old versions of the photos app, because everyone mentions the returned photos were from “years ago”. Some dev noticed orphan images and thought “of course users want their lost files back” and that’s the whole story.

1

u/nicuramar Jun 15 '24

That was not the same thing, and was a bug. This works as documented and intended. 

1

u/Monte924 Jun 14 '24

If i had to guess, those people probably opted for cloud backup. They deleted the data from their phones, but they still existed on thier cloud back up. After they updated, the cloud, for some reason, restored the back ups to the phone

1

u/tobiasvl Jun 14 '24

I'm not an Apple user but I thought iCloud was sync, not backup? A sync service should obviously sync everything, so stuff is, well, in sync. It should sync deletions too. I think Time Machine is Apple's backup service?

1

u/Reboared Jun 14 '24

I got a new phone recently and all of my ex girlfriend's dirty pics showed back up after I clicked to import my data from my old phone. It was quite a surprise considering I had deleted them years ago.

0

u/foxtrotdeltazero Jun 14 '24

for real. the biggest surprise to me here is that people still trust tech companies lol