Extract e-mail from...
 
Notifications
Clear all

Extract e-mail from iPad 2

7 Posts
6 Users
0 Likes
678 Views
(@dsshamee)
Posts: 2
New Member
Topic starter
 

Hi everyone,

I want to extract emails from an iPad 2 running iOS 6 which has not jail-broken. Is there any logical extraction method? If the physical extraction is the only way, what are the tools available for it?

Thank you!

 
Posted : 04/09/2013 4:05 pm
kray
 kray
(@kray)
Posts: 1
New Member
 

The Cellebrite system works wonders for both types of extractions on jail-broke and non jail-broke electronics. I believe the new update added iPads with the ios 6. You will have to use the UFED application on the desktop as the UFED handheld will not image apple devices. I have gotten some emails using a logical but I have found that I get much more information and of course deleted information when running a physical extraction. Hope this helps!

 
Posted : 04/09/2013 6:45 pm
Bulldawg
(@bulldawg)
Posts: 190
Estimable Member
 

Logical extraction won't get you e-mail, and physical extraction isn't possible unless it is jailbroken. Unless you want to jailbreak the device, you're not getting any e-mail. Also, if it's running iOS 6.1.3, there is no jailbreak available that I know of. iOS 6.1.2 and earlier do have jailbreaks available. Elcomsoft even has a tool to automate the jailbreak for you, but I haven't used that tool myself.

You'll have to make the call. Don't modify the device and get nothing, or modify the device with a jailbreak and try to get something.

Since it's e-mail, is there any chance you can get permission to download the e-mails from the server?

EDITKray,
When have you been able to retrieve e-mails with a logical image? I've never had an iPad 2 in my lab, but I've had lots of iPhones 4S and 5 and later generation iPads and iPods, and I've never retrieved the e-mail database from a logical image using Cellebrite. According to Cellebrite (amongst others) we are limited to logical images of iPad 2 and later on non-jailbroken devices.

 
Posted : 04/09/2013 6:55 pm
(@afentis_forensics)
Posts: 47
Eminent Member
 

i can recommend the UFED kit (www.cellebrite.com/mobile-forensic-products/ufed-touch-ultimate.html) - we've also had success with Lantern (http//katanaforensics.com/products/) and the Elcomsoft Toolkit (www.elcomsoft.co.uk/eift.html). with regards to the latter, there is a 15 day trial available at a substantially reduced rate, which may be worth looking into if this is going to be a one-off for your labs.

one of my colleagues is a Mac genius and suggests Blacklight (www.blackbagtech.com/software-products/blacklight.html). certainly feature rich but i couldn't see a cost on the website - just a button for 'request quote' - which is typically code for the retailer trying to work out how much you can afford - like the shopkeeper who looks at your shoes before telling you the price -)

Good luck - let us know how you get on.

Regards, Ross

 
Posted : 04/09/2013 11:07 pm
(@dsshamee)
Posts: 2
New Member
Topic starter
 

Thank you all for your immediate replies. But at this moment we can't afford for a tool like Cellebrite UFED. Any other suggestions please?

Regards,
Damith

 
Posted : 05/09/2013 9:26 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Do you have a budget?

What are your expectations, deadlines, needs? (by this I mean are you looking for defensible reporting for a legal matter or do you just want a copy of the emails)

Is this a personal matter, for study or for a client?

 
Posted : 05/09/2013 9:52 am
(@blackbag)
Posts: 2
New Member
 

Hi Ross,

Thank you for passing along the word about BlackLight - we appreciate it!

Our software prices are consistent and readily available. If you select the Add to Cart button ( https://www.blackbagtech.com/software-products/blacklight-1/blacklight.html ) you can see the initial software license price is $2,600 USD (private sector) and $2,200 USD (government). This entitles license holders to all BlackLight software updates at no additional cost for one year. After the initial one-year license period has expired, customers may purchase a license subscription for $800 per year ( https://www.blackbagtech.com/blacklight-license-subscription.html ) to continue receiving all BlackLight software updates at no additional cost during the one-year subscription period.

Keep in mind that there is no software functionality or customer support penalty if a customer does not renew their BlackLight license subscription. Our BlackLight software remains fully functional, and we continue to provide unlimited technical support to our customers even after a BlackLight license expires. However, customers no longer receive all BlackLight software updates at no additional cost once their license expires.

All, please feel free to contact us any time with additional questions at https://www.blackbagtech.com/contact . Our goal is to support the endeavors of our Digital Forensics community – we are here to help!

Carpe Datum,

The BlackBag Team

 
Posted : 06/09/2013 1:22 am
Share: