±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 3
Overall: 27614
Visitors: 59

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

iOS 6

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

iOS 6

Post Posted: Sun Sep 23, 2012 10:30 pm

What software/hardware can currently acquire a forensic image from a iOS 6 devices? In particular, I'm looking at the new iPhone 5 and iPad HD (3).
_________________
Marc Yu
Chief Forensics Examiner
ClearForensics.com 

marcyu
Senior Member
 
 
  

Re: iOS 6

Post Posted: Mon Sep 24, 2012 2:49 am

I don't have a iPhone 5 but have performed successful extractions on devices (iPhone4s) with iOS6 using both MPE+ and Oxygen Forensics.  

jarretlr
Newbie
 
 
  

Re: iOS 6

Post Posted: Tue Sep 25, 2012 8:31 am

If you back it up using the stock iTunes application that will be fine, take the backup out and then process the backup using a forensic tool of your choice. If you need specific file access (off course this will be limited unless the handset is jailbroken) use a tool such as iFunbox (available mac and PC) which utilized the Apple AFC protocol and download the evidential files via this software and screen shot / video cap along the way to document your process and the file creation dates etc.

If you are stuck a lot of apps have .sqlite data bases a competent examiner would be able to tear through using sqlite browser. Sometimes, when we have not yet had updates for our suites the old fashioned way may be only way to do it

Hope this helps  

mobileforensicswales
Senior Member
 
 
  

Re: iOS 6

Post Posted: Tue Sep 25, 2012 10:53 am

Be patient, it's only been out a very short time.

I think all the tool makers will be on it as soon as they can, UFED, XRY, Lantern, iXam and any others that I've missed Smile  

Adam10541
Senior Member
 
 
  

Re: iOS 6

Post Posted: Wed Sep 26, 2012 6:15 am

UFED is definitely our #1 GO-TO tool for mobile devices (then XRY, SecureView, etc). The UFED Physical Analyzer is brilliant and does a fantastic job of extracting and parsing the data. As was mentiond, IOS6 was just released, so patience is going to come in handy Smile  

ForensicRanger
Senior Member
 
 
  

Re: iOS 6

Post Posted: Wed Sep 26, 2012 7:09 am

Doesnt look like anyone has physical support for iphone 5 yet (although people have shown jailbroken devices already so fingers crossed).
I noticed the other day XRY has support for ios6 www.msab.com/posts/blo...-from-msab but Im not sure if this is for iphone 5 as well.
Ufed haven't mentioned it on their website yet, but sure they wont be long either  

cyrus
Member
 
 
  

Re: iOS 6

Post Posted: Wed Sep 26, 2012 11:55 am

No tool has a solution for physical extraction of iPhone 5.
If the device is jail broken, there is a way, otherwise iPhone 5 joined the 4S and iPad2,3 with no physical extraction solution (hopefully yet).

Logical and file system extraction is a different issue and it is possible (as long it is not locked).

iOS 6 physical on devices other than (4S, 5 , iPad2,3) do have physical support bypassing the different lock codes.

Ron  

RonS
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next