--- title: "Claude Opus 5.5 + REA 找到了我从 iPhone“永久删除”的每一张照片。" url: "https://reamcp.dev/zh-cn/cases/claude-opus-5-5-rea-found-every-photo-i-permanently-deleted--42b42b" source: "https://x.com/i/status/2114061218352615609" source_type: "x" author: "Deni" author_handle: "0xDeniAi" stars: 0 category: "安全与恶意软件分析（防御）" categories: ["security-defense"] tags: ["appdata", "claude-code", "iphone-backups", "privacy-audit", "static-analysis", "windows"] added: "2026-10-25T02:04:44.736Z" updated: "2026-10-24T18:27:26.000Z" locale: "zh-cn" content_locale: "zh-cn" --- # Claude Opus 5.5 + REA 找到了我从 iPhone“永久删除”的每一张照片。 一位用户描述了自己审计自己的 iPhone 和笔记本电脑，并通过 Claude Code 使用 REA（Reverse Engineer Anything）拆解五个已安装程序，查看哪些程序会读取隐藏的 AppData\MobileSync iPhone 备份文件夹，然后列出了具体的加固步骤。 ## Description 这篇文章讲述了一次个人隐私/安全检查：在 AppData 下的隐藏 MobileSync\Backup 文件夹中发现了未加密的 iPhone 备份，以及 iMessage、WhatsApp 和 Telegram 聊天中保留的照片。作者随后安装了 REA（'npx rea-agents setup'），并让 Claude 分析五个很少使用的程序（两个“PC 清理器”、一个视频转换器、一个旧 VPN、一个游戏启动器），以了解每个程序实际上会读取磁盘上的什么内容，结果发现其中一个清理器会遍历整个 AppData 树，包括 MobileSync。文章最后给出了修复清单（删除旧备份、启用“Encrypt local backup”、卸载未使用的程序、限制照片图库权限、清除聊天附件）以及所使用的逐字提示词，使其成为在作者自己的机器上使用 REA 的可复现防御性安全用例。 ## Original README Claude Opus 5.5 + REA found every photo I "permanently deleted" from my iPhone. they were hidden on my phone and my laptop the whole time. i plugged my iPhone into my laptop to run a backup and asked Claude Code to do a quick security check while it ran. it came back with something i wasn't looking for at all. first, the phone. every photo i had ever sent in iMessage, WhatsApp and Telegram was still there, hidden inside the chats. it doesn't show up in your gallery, so you think it's gone. i deleted those photos from my camera roll years ago. the copies in the conversations never went anywhere, and some of my chats go back to 2020. then the laptop. a hidden folder inside AppData called MobileSync\Backup. Windows hides AppData by default, so i had never seen it. inside were five old iPhone backups, the oldest from 2021, none of them encrypted. each one is a full copy of my camera roll on the day i made it. so every photo i deleted after that day was still sitting there, sorted by date. here's what Claude pulled out: a photo of my passport from a 2023 visa application screenshots of my bank app with the full account number visible private photos i sent someone and deleted right after the breakup a screenshot of my crypto seed phrase i took "just for a minute" in 2022 a photo of my ID and card that i took to remember the numbers and deleted 5 seconds later screenshots of my ex's private stories i saved in 2023 183,406 files in total, a lot of them full resolution. then i asked it to keep going. in about 4 minutes it gave me a full report: every backup with its date, size and how many photos and videos were inside, which ones were unencrypted, and a list of every program on my laptop i hadn't opened in over 6 months. that list was the scary part. just because you can't see a folder doesn't mean programs can't. any program running on the laptop can open an unencrypted backup, and i had two "PC cleaners", a free video converter, an old VPN and a game launcher i don't remember installing. so i plugged REA (Reverse Engineer Anything) into Claude Code and had it take those 5 programs apart. it showed me what each one actually reads on disk. one of the "PC cleaners" walks through the whole AppData folder on every launch, MobileSync included. that means it had access to every one of those backups for 2 years. and on the phone, 23 apps had Full Access to my photo library, meaning every photo, not just the ones i choose. weather apps, a QR scanner, a flashlight app from 2022. what i did, about 5 minutes total: 1. open iTunes or the Apple Devices app → your iPhone → Manage Backups → delete the old ones 2. tick "Encrypt local backup" so the next one is locked with a password 3. uninstall everything on Claude's "not opened in 6 months" list, starting with anything REA caught reading AppData 4. iPhone: Settings → Privacy & Security → Photos → move apps from Full Access to Limited or None 5. iPhone: Settings → General → iPhone Storage → Messages → Review Large Attachments, and clear the photos you don't want kept 6. go through old chats in WhatsApp and Telegram too, their media stays even after you delete it from the gallery here's how to run the same check yourself. for Claude Code: "find every iPhone backup on this computer, including hidden folders like AppData. for each one tell me the date, the size, how many photos and videos are inside, and whether it's encrypted. then list every installed program i haven't opened in the last 6 months. don't delete or change anything, just give me the report." for REA, install it with npx rea-agents setup, then ask Claude: "use REA to analyze every program on that list. tell me which ones read files inside AppData, and whether any of them touch the MobileSync folder." i went from 23 apps with full access to my photos to 3. send this to anyone who's ever plugged their iPhone into a laptop.