±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 146

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Is it possible to know if an iPhone has been ever jailbroken

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

Skywalker
Senior Member
 

Is it possible to know if an iPhone has been ever jailbroken

Post Posted: Jan 04, 17 00:24

I have an iPhone's Advanced Logical Extraction using UFED and I want to know if it was ever jailbroken.

I'm looking for "fstab" file in order to check its properties but I cannot find it. What could I do?

Thanks and regards!  
 
  

4n6art
Senior Member
 

Re: Is it possible to know if an iPhone has been ever jailbr

Post Posted: Jan 04, 17 01:12

The fstab file is in the system partition under:
/private/etc/fstab

The offsets you are looking for are 19-20 - not the "properties" of the file as you mentioned.

Not sure if they will tell you if the phone was *EVER* jailbroken but will tell you if the phone is currently jailbroken or not.

-=Art=-  
 
  

SamBrown
Senior Member
 

Re: Is it possible to know if an iPhone has been ever jailbr

Post Posted: Jan 09, 17 12:48

But the only way to remove a jailbreak is to restore the iOS device. This would remove all evidence of a previous jailbreak. So no, it is not possible to tell if an iPhone has been jailbroken before.  
 
  

Skywalker
Senior Member
 

Re: Is it possible to know if an iPhone has been ever jailbr

Post Posted: Jan 14, 17 03:46

- SamBrown
But the only way to remove a jailbreak is to restore the iOS device. This would remove all evidence of a previous jailbreak. So no, it is not possible to tell if an iPhone has been jailbroken before.


Are you sure of that?  
 
  

SamBrown
Senior Member
 

Re: Is it possible to know if an iPhone has been ever jailbr

Post Posted: Jan 15, 17 00:04

Pretty sure. If you search on google for how to remove a jailbreak the instructions will always tell you to restore the device.

You can apparently try to hide a jailbreak by deleting the Cydia App but the jailbreak itself is a non reversible process. During the jailbreak the iOS system itself is modified and there's no known method to undo these modification other than restoring.  
 
  

JeremyD
Newbie
 

Re: Is it possible to know if an iPhone has been ever jailbr

Post Posted: Jan 30, 17 23:00

In my testing, there were some artifacts left over after a unjailbreak event (iOS update or restore).

Searching the keyword "cydia" revealed several hits within my testing.

Jeremy  
 
  

giuseppem
Member
 

Re: Is it possible to know if an iPhone has been ever jailbr

Post Posted: Jun 09, 17 01:37

- 4n6art
The fstab file is in the system partition under:
/private/etc/fstab

The offsets you are looking for are 19-20 - not the "properties" of the file as you mentioned.

Not sure if they will tell you if the phone was *EVER* jailbroken but will tell you if the phone is currently jailbroken or not.

-=Art=-


I don't find the path you gave. Are you sure that in iPhone's Advanced Logical Extraction we can find that path?

Thank you  
 

Page 1 of 3
Page 1, 2, 3  Next