±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 32353
New Yesterday: 1 Visitors: 110

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

iOS 6

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 

iOS 6

Post Posted: Sun Sep 23, 2012 10:30 pm

What software/hardware can currently acquire a forensic image from a iOS 6 devices? In particular, I'm looking at the new iPhone 5 and iPad HD (3).
Marc Yu
Chief Forensics Examiner

Senior Member

Re: iOS 6

Post Posted: Mon Sep 24, 2012 2:49 am

I don't have a iPhone 5 but have performed successful extractions on devices (iPhone4s) with iOS6 using both MPE+ and Oxygen Forensics.  


Re: iOS 6

Post Posted: Tue Sep 25, 2012 8:31 am

If you back it up using the stock iTunes application that will be fine, take the backup out and then process the backup using a forensic tool of your choice. If you need specific file access (off course this will be limited unless the handset is jailbroken) use a tool such as iFunbox (available mac and PC) which utilized the Apple AFC protocol and download the evidential files via this software and screen shot / video cap along the way to document your process and the file creation dates etc.

If you are stuck a lot of apps have .sqlite data bases a competent examiner would be able to tear through using sqlite browser. Sometimes, when we have not yet had updates for our suites the old fashioned way may be only way to do it

Hope this helps  

Senior Member

Re: iOS 6

Post Posted: Tue Sep 25, 2012 10:53 am

Be patient, it's only been out a very short time.

I think all the tool makers will be on it as soon as they can, UFED, XRY, Lantern, iXam and any others that I've missed Smile  

Senior Member

Re: iOS 6

Post Posted: Wed Sep 26, 2012 6:15 am

UFED is definitely our #1 GO-TO tool for mobile devices (then XRY, SecureView, etc). The UFED Physical Analyzer is brilliant and does a fantastic job of extracting and parsing the data. As was mentiond, IOS6 was just released, so patience is going to come in handy Smile  

Senior Member

Re: iOS 6

Post Posted: Wed Sep 26, 2012 7:09 am

Doesnt look like anyone has physical support for iphone 5 yet (although people have shown jailbroken devices already so fingers crossed).
I noticed the other day XRY has support for ios6 www.msab.com/posts/blo...-from-msab but Im not sure if this is for iphone 5 as well.
Ufed haven't mentioned it on their website yet, but sure they wont be long either  


Re: iOS 6

Post Posted: Wed Sep 26, 2012 11:55 am

No tool has a solution for physical extraction of iPhone 5.
If the device is jail broken, there is a way, otherwise iPhone 5 joined the 4S and iPad2,3 with no physical extraction solution (hopefully yet).

Logical and file system extraction is a different issue and it is possible (as long it is not locked).

iOS 6 physical on devices other than (4S, 5 , iPad2,3) do have physical support bypassing the different lock codes.


Senior Member

Reply to topicReply to topic

Share and Like this forum topic to get more replies

Page 1 of 2
Go to page 1, 2  Next