Problem with ingest...
 
Notifications
Clear all

Problem with ingesting iPhone backup

3 Posts
2 Users
0 Likes
256 Views
(@angrymidget)
Posts: 2
New Member
Topic starter
 

I have a case where I need to perform some analysis on an iPhone 6 running the latest iOS 10. Using EnCase, I've pointed to the manifest.plist file and the only thing EnCase shows as evidence is the Phone Information. This is with both EnCase 7.12 and 8.02. The Lx01 file is on 10k in size as well, so it's not pulling all of the other relevant data from the backup into EnCase.

I noticed there is a difference in the contents of the backup folder in iTunes with the newest version of iTunes. Instead of a a bunch of files with no extensions and a few plist files and a db file, there are the expected plist and db files, but there are a bunch of folders now with the extensionless files inside those folders. I found this from a comparison of backups from old cases I've worked and the current one.

Is anyone else having this problem? It seems that this is something different because of iOS 10 and iTunes 12.5.1.21.

Any suggestions? I do not have the device in my possession to do a direct acquisition, so I have to work from the backup I have. I'll be opening a support ticket with Guidance, but I wanted to see if I got any feedback here in the meantime.

 
Posted : 15/10/2016 3:07 am
(@angrymidget)
Posts: 2
New Member
Topic starter
 

This is a known issue with iOS 10 apparently. Guidance has an enhancement in the works to support this, but for the time being I'm dead in the water. Does anyone have any suggestions on how to process this phone in the meantime?

 
Posted : 25/10/2016 12:57 am
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

See PM

 
Posted : 25/10/2016 1:57 am
Share: