±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 36303
New Yesterday: 2 Visitors: 217

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Oxygen Forensics & iOS7 Emails

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

toppock123
Member
 

Oxygen Forensics & iOS7 Emails

Post Posted: Nov 06, 13 22:17

I need to extract emails from a 4S, on ios7 (7.0.2 I believe). The only forensic tool I have at my disposal at the moment is Oxygen Forensic, running the most recent update.

The website claims that the newest version supports email extraction, but nothing has been pulled out.

My last resort was to pull out the SQLite files and export into a presentable format, but the location of this seems to changed changed from recent versions.

Has anybody had a similar experience? Or could give me a push in the right direction?

Thanks in advance!  
 
  

Jonathan
Senior Member
 

Re: Oxygen Forensics & iOS7 Emails

Post Posted: Nov 07, 13 01:52

Not sure that there's a way to extract email from the Mail app on iPhones from model 4S and later. Am pretty sure Oxygen wouldn't have said otherwise.
_________________
Forensic Control
twitter.com/ForensicControl
St Bride Foundation, 14 Bride Lane, London, EC4Y 8EQ 
 
  

AlanC
Newbie
 

Re: Oxygen Forensics & iOS7 Emails

Post Posted: Nov 07, 13 03:29

Hi toppock123,

Unfortunately this is handset depended rather than iOS dependent. From my understanding, iOS devices prior to the iPhone 4S and iPad 2 will support email extraction. So oxygen will be able to extract email data with an iPhone 4 running iOS7. However, newer devices (iPhone 4S, 5, 5S, 5C, iPad 2, 3, 4, Mini, Mini Retina and Air) will not support email extractions due to the hardware encryption technology used within the CPU's of the devices.

I hope that helps.

Regards,
Alan
_________________
Alan C 
 
  

DCS1094
Senior Member
 

Re: Oxygen Forensics & iOS7 Emails

Post Posted: Nov 07, 13 04:10

Is the iPhone 4S jailbroken??  
 
  

toppock123
Member
 

Re: Oxygen Forensics & iOS7 Emails

Post Posted: Nov 07, 13 14:17

That's very strange, I thought I remembered using XRY and UFED a while back on a 4S and it extracted emails. I'm also slightly annoyed that the Oxygen website states this:

General user activity data

Phonebook with assigned photos
Calendar events and notes
Calls log (facetime, dialed, received and missed calls)
Messages (SMS/MMS, iMessages, e-mails)
Camera snapshots, video and music
Voice mail
Passwords
Dictionaries

If Oxygen is not the way forward, does anybody have a solution as to how I can extract these emails? We are looking to invest in a new tool anyway so buying a new tool is not completely out of the question.

No the phone is not jailbroken, and I would rather not resort to that.

Thank you for your responses.  
 
  

OxygenForensics
Senior Member
 

Re: Oxygen Forensics & iOS7 Emails

Post Posted: Nov 07, 13 16:16

Hi toppock123,

Email extractions are supported for all jailbroken devices regardless their iOS.
If the device is not jailbroken emails from the built-in app won't be available after logical extraction.

AlanC is quite right about the encryption technology for the latest iOS devices. So physical image for those devices is useless and all forensic tools do logical only using standard iTunes backup procedure.

Emails are still accessible if there were 3rd-party applications installed into the device - Gmail, Yahoo etc.

With iOS version earlier than 7 we can decrypt a keychain file where mail box password is stored. So you can still have an access to Emails from a PC, f.ex.

Regards,
Galina Rabotenko  
 
  

DCS1094
Senior Member
 

Re: Oxygen Forensics & iOS7 Emails

Post Posted: Nov 07, 13 17:55

- toppock123
That's very strange, I thought I remembered using XRY and UFED a while back on a 4S and it extracted emails. I'm also slightly annoyed that the Oxygen website states this:

General user activity data

Phonebook with assigned photos
Calendar events and notes
Calls log (facetime, dialed, received and missed calls)
Messages (SMS/MMS, iMessages, e-mails)
Camera snapshots, video and music
Voice mail
Passwords
Dictionaries

If Oxygen is not the way forward, does anybody have a solution as to how I can extract these emails? We are looking to invest in a new tool anyway so buying a new tool is not completely out of the question.

No the phone is not jailbroken, and I would rather not resort to that.

Thank you for your responses.


Cellebrite, XRY and Oxygen can only extract emails from built in 'Mail' app if the device is jailbroken. The only other option really is for a manual examination!  
 

Page 1 of 2
Page 1, 2  Next