±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35538
New Yesterday: 1 Visitors: 125

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Extract e-mail from iPad 2

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

dsshamee
Newbie
 

Extract e-mail from iPad 2

Post Posted: Sep 04, 13 16:05

Hi everyone,

I want to extract emails from an iPad 2 running iOS 6 which has not jail-broken. Is there any logical extraction method? If the physical extraction is the only way, what are the tools available for it?

Thank you!  
 
  

kray
Newbie
 

Re: Extract e-mail from iPad 2

Post Posted: Sep 04, 13 18:45

The Cellebrite system works wonders for both types of extractions on jail-broke and non jail-broke electronics. I believe the new update added iPads with the ios 6. You will have to use the UFED application on the desktop as the UFED handheld will not image apple devices. I have gotten some emails using a logical but I have found that I get much more information and of course deleted information when running a physical extraction. Hope this helps!  
 
  

Bulldawg
Senior Member
 

Re: Extract e-mail from iPad 2

Post Posted: Sep 04, 13 18:55

Logical extraction won't get you e-mail, and physical extraction isn't possible unless it is jailbroken. Unless you want to jailbreak the device, you're not getting any e-mail. Also, if it's running iOS 6.1.3, there is no jailbreak available that I know of. iOS 6.1.2 and earlier do have jailbreaks available. Elcomsoft even has a tool to automate the jailbreak for you, but I haven't used that tool myself.

You'll have to make the call. Don't modify the device and get nothing, or modify the device with a jailbreak and try to get something.

Since it's e-mail, is there any chance you can get permission to download the e-mails from the server?

EDIT:Kray,
When have you been able to retrieve e-mails with a logical image? I've never had an iPad 2 in my lab, but I've had lots of iPhones 4S and 5 and later generation iPads and iPods, and I've never retrieved the e-mail database from a logical image using Cellebrite. According to Cellebrite (amongst others) we are limited to logical images of iPad 2 and later on non-jailbroken devices.  
 
  

AFENTIS_Forensics
Member
 

Re: Extract e-mail from iPad 2

Post Posted: Sep 04, 13 23:07

i can recommend the UFED kit (www.cellebrite.com/mobile-forensic-products/ufed-touch-ultimate.html) - we've also had success with Lantern (http://katanaforensics.com/products/) and the Elcomsoft Toolkit (www.elcomsoft.co.uk/eift.html). with regards to the latter, there is a 15 day trial available at a substantially reduced rate, which may be worth looking into if this is going to be a one-off for your labs.

one of my colleagues is a Mac genius and suggests Blacklight (www.blackbagtech.com/software-products/blacklight.html). certainly feature rich but i couldn't see a cost on the website - just a button for 'request quote' - which is typically code for the retailer trying to work out how much you can afford - like the shopkeeper who looks at your shoes before telling you the price Smile

Good luck - let us know how you get on.

Regards, Ross  
 
  

dsshamee
Newbie
 

Re: Extract e-mail from iPad 2

Post Posted: Sep 05, 13 09:26

Thank you all for your immediate replies. But at this moment we can't afford for a tool like Cellebrite UFED. Any other suggestions please?

Regards,
Damith  
 
  

Adam10541
Senior Member
 

Re: Extract e-mail from iPad 2

Post Posted: Sep 05, 13 09:52

Do you have a budget?

What are your expectations, deadlines, needs? (by this I mean are you looking for defensible reporting for a legal matter or do you just want a copy of the emails)

Is this a personal matter, for study or for a client?  
 
  

blackbag
Newbie
 

Re: Extract e-mail from iPad 2

Post Posted: Sep 06, 13 01:22

Hi Ross,

Thank you for passing along the word about BlackLight - we appreciate it!

Our software prices are consistent and readily available. If you select the Add to Cart button (https://www.blackbagtech.com/software-products/blacklight-1/blacklight.html) you can see the initial software license price is $2,600 USD (private sector) and $2,200 USD (government). This entitles license holders to all BlackLight software updates at no additional cost for one year. After the initial one-year license period has expired, customers may purchase a license subscription for $800 per year (https://www.blackbagtech.com/blacklight-license-subscription.html) to continue receiving all BlackLight software updates at no additional cost during the one-year subscription period.

Keep in mind that there is no software functionality or customer support penalty if a customer does not renew their BlackLight license subscription. Our BlackLight software remains fully functional, and we continue to provide unlimited technical support to our customers even after a BlackLight license expires. However, customers no longer receive all BlackLight software updates at no additional cost once their license expires.

All, please feel free to contact us any time with additional questions at https://www.blackbagtech.com/contact. Our goal is to support the endeavors of our Digital Forensics community -- we are here to help!

Carpe Datum,

The BlackBag Team  
 

Page 1 of 1