Claude Opus 5.5 + REA found every photo I "permanently deleted" from my iPhone. they were hidden on my phone and my laptop the whole time. i plugged my iPhone into my laptop to run a backup and asked Claude Code to do a quick security check while it ran. it came back with something i wasn't looking for at all. first, the phone. every photo i had ever sent in iMessage, WhatsApp and Telegram was still there, hidden inside the chats. it doesn't show up in your gallery, so you think it's gone. i deleted those photos from my camera roll years ago. the copies in the conversations never went anywhere, and some of my chats go back to 2020. then the laptop. a hidden folder inside AppData called MobileSync\Backup. Windows hides AppData by default, so i had never seen it. inside were five old iPhone backups, the oldest from 2021, none of them encrypted. each one is a full copy of my camera roll on the day i made it. so every photo i deleted after that day was still sitting there, sorted by date. here's what Claude pulled out: a photo of my passport from a 2023 visa application screenshots of my bank app with the full account number visible private photos i sent someone and deleted right after the breakup a screenshot of my crypto seed phrase i took "just for a minute" in 2022 a photo of my ID and card that i took to remember the numbers and deleted 5 seconds later screenshots of my ex's private stories i saved in 2023 183,406 files in total, a lot of them full resolution. then i asked it to keep going. in about 4 minutes it gave me a full report: every backup with its date, size and how many photos and videos were inside, which ones were unencrypted, and a list of every program on my laptop i hadn't opened in over 6 months. that list was the scary part. just because you can't see a folder doesn't mean programs can't. any program running on the laptop can open an unencrypted backup, and i had two "PC cleaners", a free video converter, an old VPN and a game launcher i don't remember installing. so i plugged REA (Reverse Engineer Anything) into Claude Code and had it take those 5 programs apart. it showed me what each one actually reads on disk. one of the "PC cleaners" walks through the whole AppData folder on every launch, MobileSync included. that means it had access to every one of those backups for 2 years. and on the phone, 23 apps had Full Access to my photo library, meaning every photo, not just the ones i choose. weather apps, a QR scanner, a flashlight app from 2022. what i did, about 5 minutes total: 1. open iTunes or the Apple Devices app → your iPhone → Manage Backups → delete the old ones 2. tick "Encrypt local backup" so the next one is locked with a password 3. uninstall everything on Claude's "not opened in 6 months" list, starting with anything REA caught reading AppData 4. iPhone: Settings → Privacy & Security → Photos → move apps from Full Access to Limited or None 5. iPhone: Settings → General → iPhone Storage → Messages → Review Large Attachments, and clear the photos you don't want kept 6. go through old chats in WhatsApp and Telegram too, their media stays even after you delete it from the gallery here's how to run the same check yourself. for Claude Code: "find every iPhone backup on this computer, including hidden folders like AppData. for each one tell me the date, the size, how many photos and videos are inside, and whether it's encrypted. then list every installed program i haven't opened in the last 6 months. don't delete or change anything, just give me the report." for REA, install it with npx rea-agents setup, then ask Claude: "use REA to analyze every program on that list. tell me which ones read files inside AppData, and whether any of them touch the MobileSync folder." i went from 23 apps with full access to my photos to 3. send this to anyone who's ever plugged their iPhone into a laptop.
Claude Opus 5.5 + REA found every photo I "permanently deleted" from my iPhone.
A user describes auditing their own iPhone and laptop and using REA (Reverse Engineer Anything) through Claude Code to take apart five installed programs and see which ones read the hidden AppData\MobileSync iPhone backup folder, then lists concrete hardening steps.
About this case
The post recounts a personal privacy/security check: unencrypted iPhone backups were found in the hidden MobileSync\Backup folder under AppData, along with photos retained inside iMessage, WhatsApp and Telegram chats. The author then installed REA ('npx rea-agents setup') and had Claude analyse five seldom-used programs (two 'PC cleaners', a video converter, an old VPN, a game launcher) to learn what each actually reads on disk, finding that one cleaner walks the whole AppData tree including MobileSync. The write-up ends with a remediation checklist (delete old backups, enable 'Encrypt local backup', uninstall unused programs, restrict photo-library permissions, clear chat attachments) and the verbatim prompts used, making it a reproducible defensive-security use case for REA on the author's own machine.
Setup
See the original source for installation instructions.
Original text / README
Claude Opus 5.5 + REA found every photo I "permanently deleted" from my iPhone. they were hidden on my phone and my laptop the whole time.
i plugged my iPhone into my laptop to run a backup and asked Claude Code to do a quick security check while it ran. it came back with something i wasn't looking for at all.
first, the phone. every photo i had ever sent in iMessage, WhatsApp and Telegram was still there, hidden inside the chats. it doesn't show up in your gallery, so you think it's gone. i deleted those photos from my camera roll years ago. the copies in the conversations never went anywhere, and some of my chats go back to 2020.
then the laptop. a hidden folder inside AppData called MobileSync\Backup. Windows hides AppData by default, so i had never seen it. inside were five old iPhone backups, the oldest from 2021, none of them encrypted. each one is a full copy of my camera roll on the day i made it. so every photo i deleted after that day was still sitting there, sorted by date.
here's what Claude pulled out:
a photo of my passport from a 2023 visa application screenshots of my bank app with the full account number visible private photos i sent someone and deleted right after the breakup a screenshot of my crypto seed phrase i took "just for a minute" in 2022 a photo of my ID and card that i took to remember the numbers and deleted 5 seconds later screenshots of my ex's private stories i saved in 2023
183,406 files in total, a lot of them full resolution.
then i asked it to keep going. in about 4 minutes it gave me a full report: every backup with its date, size and how many photos and videos were inside, which ones were unencrypted, and a list of every program on my laptop i hadn't opened in over 6 months.
that list was the scary part. just because you can't see a folder doesn't mean programs can't. any program running on the laptop can open an unencrypted backup, and i had two "PC cleaners", a free video converter, an old VPN and a game launcher i don't remember installing.
so i plugged REA (Reverse Engineer Anything) into Claude Code and had it take those 5 programs apart. it showed me what each one actually reads on disk. one of the "PC cleaners" walks through the whole AppData folder on every launch, MobileSync included. that means it had access to every one of those backups for 2 years.
and on the phone, 23 apps had Full Access to my photo library, meaning every photo, not just the ones i choose. weather apps, a QR scanner, a flashlight app from 2022.
what i did, about 5 minutes total:
- open iTunes or the Apple Devices app → your iPhone → Manage Backups → delete the old ones
- tick "Encrypt local backup" so the next one is locked with a password
- uninstall everything on Claude's "not opened in 6 months" list, starting with anything REA caught reading AppData
- iPhone: Settings → Privacy & Security → Photos → move apps from Full Access to Limited or None
- iPhone: Settings → General → iPhone Storage → Messages → Review Large Attachments, and clear the photos you don't want kept
- go through old chats in WhatsApp and Telegram too, their media stays even after you delete it from the gallery
here's how to run the same check yourself.
for Claude Code:
"find every iPhone backup on this computer, including hidden folders like AppData. for each one tell me the date, the size, how many photos and videos are inside, and whether it's encrypted. then list every installed program i haven't opened in the last 6 months. don't delete or change anything, just give me the report."
for REA, install it with npx rea-agents setup, then ask Claude:
"use REA to analyze every program on that list. tell me which ones read files inside AppData, and whether any of them touch the MobileSync folder."
i went from 23 apps with full access to my photos to 3. send this to anyone who's ever plugged their iPhone into a laptop.
Similar projects
A black-box audit of the author's own portal: what can an anonymous visitor see, and what does the app leak, checked with REA from the outside.
✳︎ Outside-in leak check of a production Next.js and Stripe app
└─ Make every conversation easier
Outside-in leak check of a production Next.js and Stripe app
Author self-red-teams their own closed-source P2P messaging app by running REA on its TUI, APK, and WASM binaries to evaluate decompilation resistance, sharing the decompiled repo.
✳︎ I Red-Teamed Myself to Learn About Reverse Engineering
└─ Make every conversation easier