±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 13
Overall: 26756
Visitors: 62

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Determine if and when iPod was backed up?

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Determine if and when iPod was backed up?

Post Posted: Tue Dec 04, 2012 12:46 pm

Hi All,

Does anyone know if it is possible to determine, if and when an iPod Touch was last backed up from an image of the device? Its not jailbroken and it was a RAM Disk extraction using XRY. The device is an iPod Touch, 4th Gen, with iOS5 installed.

Kind Regards

jm25  

jm25
Member
 
 
  

Re: Determine if and when iPod was backed up?

Post Posted: Tue Dec 04, 2012 4:00 pm

When you say backed up from an image do you mean that the user has selected the "restore" option?

Do you have the PC it was synced to or the device or both?

And do you have a test device to check.
You can check the registry to see the last device that was connected, and you can check in the appdata folder for itunes all of the devices that were connected and synced. I'm not sure if this will have what youre looking for though.  

randomaccess
Senior Member
 
 
  

Re: Determine if and when iPod was backed up?

Post Posted: Tue Dec 04, 2012 4:25 pm

- jm25

Does anyone know if it is possible to determine, if and when an iPod Touch was last backed up from an image of the device? Its not jailbroken and it was a RAM Disk extraction using XRY. The device is an iPod Touch, 4th Gen, with iOS5 installed.


So, you're asking how to determine when that iPod was last restored from the XRY image that was created?

I'm sorry, but your statement, "...backed up from an image..." is somewhat confusing.  

keydet89
Senior Member
 
 
  

Re: Determine if and when iPod was backed up?

Post Posted: Tue Dec 04, 2012 4:57 pm

Sorry for the ambiguity. Unfortunately we dont have the PC it is synced with. Basically we are trying to determine if the iPod was ever backed up to a PC, and if so, when. All we have to work from is an XRY Ram Disk dump.

Thanks  

jm25
Member
 
 
  

Re: Determine if and when iPod was backed up?

Post Posted: Tue Dec 04, 2012 7:24 pm

What your really asking then is if an iPod stores a file locally when it is synced with a PC/Mac.

If it does store something locally then how to find and interpret that information and figure out the date the sync occurred on?

I've never heard of an iPod creating a file locally when it is synced, but even if iTunes did do something like that, there are numerous other tools out there for backing up and dealing with iPods so I think you may be up a creek without a paddle.

What is the end goal here? how does knowing if and when it was backed up assist?  

Adam10541
Senior Member
 
 
  

Re: Determine if and when iPod was backed up?

Post Posted: Wed Dec 05, 2012 4:18 am

Thanks for your input. We are just trying to support / refute a claim made by the person in question. Having this information would help with it.

Thanks again  

jm25
Member
 
 
  

Re: Determine if and when iPod was backed up?

Post Posted: Wed Dec 05, 2012 7:04 am

I got interested in the question in general, and started looking around on Google, and found some things that might be potentially useful. I would think that if there were some such artifacts, they would be found in a plist file.

Caveat: I don't have a means of imaging my own iPod, so I can't test any of this...

I found a presentation from 2009, regarding a file called iSync.vcf, and in the presentation I found (just slides, no audio), it seemed to indicate that there might be something of value there.

Other files that may be of interest:
gtkpod.pref
SysInfo

I found another presentation from 2007 that indicated that there were two files created on the iPod after the device is connected to a system and interacts with iTunes:
\iPod_Control\iTunes\DeviceInfo
\iPod_Control\iTunes\SysInfo  

keydet89
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next