Notifications
Clear all

iOS 6

13 Posts
8 Users
0 Likes
1,286 Views
KungFuAction
(@kungfuaction)
Posts: 109
Estimable Member
Topic starter
 

What software/hardware can currently acquire a forensic image from a iOS 6 devices? In particular, I'm looking at the new iPhone 5 and iPad HD (3).

 
Posted : 24/09/2012 9:30 am
(@jarretlr)
Posts: 3
New Member
 

I don't have a iPhone 5 but have performed successful extractions on devices (iPhone4s) with iOS6 using both MPE+ and Oxygen Forensics.

 
Posted : 24/09/2012 1:49 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

If you back it up using the stock iTunes application that will be fine, take the backup out and then process the backup using a forensic tool of your choice. If you need specific file access (off course this will be limited unless the handset is jailbroken) use a tool such as iFunbox (available mac and PC) which utilized the Apple AFC protocol and download the evidential files via this software and screen shot / video cap along the way to document your process and the file creation dates etc.

If you are stuck a lot of apps have .sqlite data bases a competent examiner would be able to tear through using sqlite browser. Sometimes, when we have not yet had updates for our suites the old fashioned way may be only way to do it

Hope this helps

 
Posted : 25/09/2012 7:31 pm
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Be patient, it's only been out a very short time.

I think all the tool makers will be on it as soon as they can, UFED, XRY, Lantern, iXam and any others that I've missed )

 
Posted : 25/09/2012 9:53 pm
ForensicRanger
(@forensicranger)
Posts: 122
Estimable Member
 

UFED is definitely our #1 GO-TO tool for mobile devices (then XRY, SecureView, etc). The UFED Physical Analyzer is brilliant and does a fantastic job of extracting and parsing the data. As was mentiond, IOS6 was just released, so patience is going to come in handy )

 
Posted : 26/09/2012 5:15 pm
cyrus
(@cyrus)
Posts: 26
Eminent Member
 

Doesnt look like anyone has physical support for iphone 5 yet (although people have shown jailbroken devices already so fingers crossed).
I noticed the other day XRY has support for ios6 http//www.msab.com/posts/blog/new-releases-from-msab but Im not sure if this is for iphone 5 as well.
Ufed haven't mentioned it on their website yet, but sure they wont be long either

 
Posted : 26/09/2012 6:09 pm
 RonS
(@rons)
Posts: 358
Reputable Member
 

No tool has a solution for physical extraction of iPhone 5.
If the device is jail broken, there is a way, otherwise iPhone 5 joined the 4S and iPad2,3 with no physical extraction solution (hopefully yet).

Logical and file system extraction is a different issue and it is possible (as long it is not locked).

iOS 6 physical on devices other than (4S, 5 , iPad2,3) do have physical support bypassing the different lock codes.

Ron

 
Posted : 26/09/2012 10:55 pm
(@randomaccess)
Posts: 385
Reputable Member
 

With any luck someone will find a bug in the a6 chip that lets people get physicals/passwords.
And with more luck that bug existed in the a5 chip as well so we can get the same features for the 4s

@ron is cellebrite working on cracking the firmware or is there a way to get apple to help us out?

 
Posted : 19/10/2012 7:45 am
 RonS
(@rons)
Posts: 358
Reputable Member
 

Cellebrite is working on several parallel methods that will hopefully help.

 
Posted : 19/10/2012 10:23 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Anyone had luck processing 3GS with iOS 6?

I'm testing my old phone which was factory reset then updated to iOS 6 and UFED 3.3 PA is supposed to support this but after I put the device in recovery mode PA says it can't detect the iOS build and cannot process the phone.

I'm curious if this is a PA issue or a hardware issue with my old phone.

 
Posted : 19/10/2012 1:33 pm
Page 1 / 2
Share: