New Today: 4
New Yesterday: 10
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
iphone itunes backup
Subforums: Mobile Telephone Case Law
Long time reader, first time poster/problem poser !
We don't have have access to the iphone (device was destroyed), however we do have access to the computer on which a backup from the device was made via itunes. I used Elcomsoft's Phone password breaker (v 1.81 I think, will check to make sure). We have managed to get the password for the backup and decided to take a look at the keychain via this programs explorer. There appears to be a few entries that are still encrypted. What methodologies could be utilized to possibly further decrypt this ? I've located the lockdown folder on the computer and looked at it with a XML editor and found the escrow keybag entry, which is hex 64 encoded. Could this be utilized to decrypt what I'm seeing in the keychain ?
Thanks for your help in advance. If anyone needs anymore info, I'll provide as much as I can !