Notifications
Clear all

IPOD Touch

8 Posts
6 Users
0 Likes
491 Views
diesel
(@diesel)
Posts: 18
Active Member
Topic starter
 

has anyone had the pleasure of acquiring an image of an Ipod Touch yet?

It is detected in windows as a digital camera so not picked up by Encase or FTK imager as a physical device to image.

I am about to test if by installing Itunes and updating the driver I can get windows to recognise the ipod touch as an ipod touch and not a camera, and if this effects the integrity of the data.

has anyone got any suggests for another approach or has done an Ipod touch in a different way?

thanks in advance

 
Posted : 16/12/2008 9:36 pm
 sean
(@sean)
Posts: 10
Active Member
 

Have you managed to image the itouch. I haven't given it a go yet but it seems like a interesting thing to do.

It would be interesting what you can pull off it with the thing they say about the itouch/iphone taking screenshots of everything you do etc…

I think that you dont really need to install itunes you just need the usb drivers which you can extract from the exe.

I remeber my old ipod mounted as a physical drive in linux but not too sure about itouch. Have you attempted that yet?

 
Posted : 16/12/2008 9:47 pm
(@bithead)
Posts: 1206
Noble Member
 

A couple of books on my Christmas List
-iPhone Forensics
Recovering Evidence, Personal Data, and Corporate Assets

-Mac OS X, iPod, and iPhone Forensic Analysis DVD Toolkit (Paperback)

 
Posted : 16/12/2008 9:50 pm
diesel
(@diesel)
Posts: 18
Active Member
Topic starter
 

thanks for the replies.

i have tried it in Linux where it was not detected as a USB device at all.

updating the driver also did not work as windows now detects it as an Apply Ipod camera and not just a digital camers so still not detected in FTK or EnCase.

thank u calimelo i will look in to the software Wolf and see if it suits are needs.

any other ideas will be greatly appreciated in the mean time ill keep trying

regards

 
Posted : 17/12/2008 4:47 pm
MacForensics
(@macforensics)
Posts: 5
Active Member
 

As stated previously, you can jailbreak the iPod Touch (as long as it's not a 2nd gen Touch), install SSH and then push the data out over SSH but that does require modification of the iPod's file system.

You can use MacLockPick to extract all the information that's contained on the iPod from the computer it's synced with.

 
Posted : 17/12/2008 10:42 pm
 sean
(@sean)
Posts: 10
Active Member
 

Well, i managed to image my ipod touch. i done it through ssh. It took a while to complete the process.

 
Posted : 18/12/2008 10:15 pm
alex101
(@alex101)
Posts: 105
Estimable Member
 

Also mentioned in previous threads a program called WOLF. I've found It works well for me with iPhones and iPod touch (1st and 2nd generation).

http//sixthlegion.com/about/AboutWolf.html

 
Posted : 22/12/2008 4:13 pm
(@mobilephoneforensic)
Posts: 73
Trusted Member
 

Wolf is a good tool to use for ipod touch/iphones but it only gives you a dump of the logical data stored on the device. No deleted data can be recovered. Still researching recovering deleted data from the ipod touch/iphone. Will post results very soon.

 
Posted : 27/12/2008 3:46 am
Share: