Iphone Software Upd...
 
Notifications
Clear all

Iphone Software Update

5 Posts
3 Users
0 Likes
1,019 Views
(@buttonmonkey)
Posts: 8
Active Member
Topic starter
 

Good Morning all.

Long time lurker first time poster here.

I have a question which I hope someone will know the answer to.

I am currently doing an analysis of an iPhone 4 (Model A1332) running IOS 6.1.3. I am using UFED physical analyser 3.9.8.7.

On the extraction summary screen in the General section there is a section called Last Factory Restore\Upgrade with the date and the time.

Can anyone tell me where this is stored on the device? Is there a particular Plist or database that records when the phone was updated, or is it buried else where? I've tried asking the oracle (Google) and checked a few books but I'm not having any joy.

Essentially I want to be able to verify the data that UFED has extracted, as some photographs have a software version of 6.1.2 and some with 6.1.3.

I know it's in there somewhere but I cannot for the life find it.

Thanks

ButtonMonkey

 
Posted : 27/08/2014 5:47 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Unless I'm missing something it wouldn't be unusual for a phone to have photographs on it that were taken with previous versions of iOS..

Does the upgrade time listed in the report make sense when you look at the exif data on the pictures that are reporting different iOS builds? ie is the picture with 6.1.3 iOS build taken after the upgrade date listed?

a PM to Ron Serber on here would be my suggestion if you need to locate where that data has come from.

 
Posted : 27/08/2014 7:15 am
(@buttonmonkey)
Posts: 8
Active Member
Topic starter
 

There is no issue when the photographs were taken with the previous software, this is something I expected. The EXIF data for the photographs matches up with the correct date and time.

What I am trying to find out is where the software update date/time is stored.

UFED has extracted that it was updated on 5th June 2103 but I want to know where UFED extracted that from. The extraction summary screen provides the info but not where the info was obtained from.

Is it a Plist file, is it stored elsewhere?

 
Posted : 27/08/2014 7:21 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

I checked a few downloads that I have to find one that lists the last restore / update data and I couldn't find anything definitive..however I did find a log file at the following path

Under the File Systems tree entry within PA

DATA (Apple HFS[+])–>Data–>MobileSoftwareUpdate–>restore.log

This file had a last accessed data/time that was within 10 seconds of the time reported by PA under the general window. I confirmed the last accessed time stamps for that file within Xways Forensics, however Xways can't decode the log file where as the text of this log file can be viewed via the PA software.

Not exactly the same time though so I suspect not where the information is drawn from, however Ron Serber is the inside contact for UFED and he will be able to find out what you need to know. I'd be curious to know as well if you can post here when you find out.

 
Posted : 27/08/2014 10:50 am
(@johpe)
Posts: 6
Active Member
 

Hi,

The information about last update/restore date of an iDevice can be found in the beginning of this file

/private/var/logs/AppleSupport/general.log

Simply search for "general.log" in the files section of your extraction and you will find it. Please note that it's not stored in the iTunes backup.

Regards,

Johan

 
Posted : 01/09/2014 9:59 pm
Share: