±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 3
New Yesterday: 5
Overall: 27497
Visitors: 77

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Safari Cookies on Apple iPad 2

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Safari Cookies on Apple iPad 2

Post Posted: Wed Dec 12, 2012 1:30 pm

I have a case in which the client wishes to recover date and time stamps from Safari's Internet cookies. We can see the cookies but not the date and time stamps, which are critical - of course. Unforturnately, the user had deleted Internet history so all that is left are the cookies. When I imaged the iPad in MPE+, no cookies were recorded - although they are clearly there.

Is there any way to download the cookies along with their date and time stamps?
_________________
David J. Penrod
Computer Forensic Analyst
PenrodEllis Forensic Data Discovery
1805 S. Bellaire St., Ste. 401
Denver, Colorado 80222
(303) 691-0047 

dpenrod
Member
 
 
  

Re: Safari Cookies on Apple iPad 2

Post Posted: Thu Dec 13, 2012 3:46 am

You will need to Jailbreak the device and download its files using the AFC protocol. What are your clients looking for... Have you considered all the tasty internet artifacts in the Cache.db

forensicsfromthesausag...on-of.html  

mobileforensicswales
Senior Member
 
 
  

Re: Safari Cookies on Apple iPad 2

Post Posted: Thu Dec 13, 2012 4:43 am

Hi, if you have the ".binarycookies" files then you should be able to parse the files using Dunk:

www.cclgroupltd.com/Bu...-tool.html

And if you can get hold of the Cache.db, I second mobileforensicswales enthusiasm: that file is a goldmine.  

AlexC
Senior Member
 
 
  

Re: Safari Cookies on Apple iPad 2

Post Posted: Tue Jan 08, 2013 5:45 pm

Thank you for your help. I purchased Dunk! from CCL Forensics and it works great. I have one question:

Are the timestamps local time (Denver, Colorado) or are they UTC, which is 7 hours ahead of Denver time?
_________________
David J. Penrod
Computer Forensic Analyst
PenrodEllis Forensic Data Discovery
1805 S. Bellaire St., Ste. 401
Denver, Colorado 80222
(303) 691-0047 

dpenrod
Member
 
 
  

Re: Safari Cookies on Apple iPad 2

Post Posted: Wed Jan 09, 2013 1:26 am

- mobileforensicswales
You will need to Jailbreak the device and download its files using the AFC protocol. What are your clients looking for... Have you considered all the tasty internet artifacts in the Cache.db


have you found a way to jailbreak the device?
i thought that the ipad1 was the only one that could be jailbroken  

randomaccess
Senior Member
 
 
  

Re: Safari Cookies on Apple iPad 2

Post Posted: Wed Jan 09, 2013 1:29 am

- dpenrod
Thank you for your help. I purchased Dunk! from CCL Forensics and it works great. I have one question:

Are the timestamps local time (Denver, Colorado) or are they UTC, which is 7 hours ahead of Denver time?


firstly, do you have another ipad to test it on?
and secondly, what ever your findings can you please post them up here?

or iphonewiki
or forensicwiki

thanks  

randomaccess
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 1