±Your Account
Membership:
New Today: 4
New Yesterday: 10
Overall: 24370
Visitors: 64
±Latest Articles
· Catching the ghost: how to discover ephemeral evidence with Live RAM analysis
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
iphone itunes backup
iphone itunes backup
Posted: Mon May 07, 2012 4:55 pm
Hi guys !
Long time reader, first time poster/problem poser !
We don't have have access to the iphone (device was destroyed), however we do have access to the computer on which a backup from the device was made via itunes. I used Elcomsoft's Phone password breaker (v 1.81 I think, will check to make sure). We have managed to get the password for the backup and decided to take a look at the keychain via this programs explorer. There appears to be a few entries that are still encrypted. What methodologies could be utilized to possibly further decrypt this ? I've located the lockdown folder on the computer and looked at it with a XML editor and found the escrow keybag entry, which is hex 64 encoded. Could this be utilized to decrypt what I'm seeing in the keychain ?
Thanks for your help in advance. If anyone needs anymore info, I'll provide as much as I can !
Cheers,
Steve
Long time reader, first time poster/problem poser !
We don't have have access to the iphone (device was destroyed), however we do have access to the computer on which a backup from the device was made via itunes. I used Elcomsoft's Phone password breaker (v 1.81 I think, will check to make sure). We have managed to get the password for the backup and decided to take a look at the keychain via this programs explorer. There appears to be a few entries that are still encrypted. What methodologies could be utilized to possibly further decrypt this ? I've located the lockdown folder on the computer and looked at it with a XML editor and found the escrow keybag entry, which is hex 64 encoded. Could this be utilized to decrypt what I'm seeing in the keychain ?
Thanks for your help in advance. If anyone needs anymore info, I'll provide as much as I can !
Cheers,
Steve
-
steve_1974 - Newbie
