What software/hardware can currently acquire a forensic image from a iOS 6 devices? In particular, I'm looking at the new iPhone 5 and iPad HD (3).
I don't have a iPhone 5 but have performed successful extractions on devices (iPhone4s) with iOS6 using both MPE+ and Oxygen Forensics.
If you back it up using the stock iTunes application that will be fine, take the backup out and then process the backup using a forensic tool of your choice. If you need specific file access (off course this will be limited unless the handset is jailbroken) use a tool such as iFunbox (available mac and PC) which utilized the Apple AFC protocol and download the evidential files via this software and screen shot / video cap along the way to document your process and the file creation dates etc.
If you are stuck a lot of apps have .sqlite data bases a competent examiner would be able to tear through using sqlite browser. Sometimes, when we have not yet had updates for our suites the old fashioned way may be only way to do it
Hope this helps
Be patient, it's only been out a very short time.
I think all the tool makers will be on it as soon as they can, UFED, XRY, Lantern, iXam and any others that I've missed )
UFED is definitely our #1 GO-TO tool for mobile devices (then XRY, SecureView, etc). The UFED Physical Analyzer is brilliant and does a fantastic job of extracting and parsing the data. As was mentiond, IOS6 was just released, so patience is going to come in handy )
Doesnt look like anyone has physical support for iphone 5 yet (although people have shown jailbroken devices already so fingers crossed).
I noticed the other day XRY has support for ios6 http//
Ufed haven't mentioned it on their website yet, but sure they wont be long either
No tool has a solution for physical extraction of iPhone 5.
If the device is jail broken, there is a way, otherwise iPhone 5 joined the 4S and iPad2,3 with no physical extraction solution (hopefully yet).
Logical and file system extraction is a different issue and it is possible (as long it is not locked).
iOS 6 physical on devices other than (4S, 5 , iPad2,3) do have physical support bypassing the different lock codes.
Ron
With any luck someone will find a bug in the a6 chip that lets people get physicals/passwords.
And with more luck that bug existed in the a5 chip as well so we can get the same features for the 4s
@ron is cellebrite working on cracking the firmware or is there a way to get apple to help us out?
Cellebrite is working on several parallel methods that will hopefully help.
Anyone had luck processing 3GS with iOS 6?
I'm testing my old phone which was factory reset then updated to iOS 6 and UFED 3.3 PA is supposed to support this but after I put the device in recovery mode PA says it can't detect the iOS build and cannot process the phone.
I'm curious if this is a PA issue or a hardware issue with my old phone.