±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 1 Overall: 35657
New Yesterday: 3 Visitors: 162

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Almost certainly not "forensically sound" ...

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3  Next 
  

azrael
Senior Member
 

Almost certainly not "forensically sound" ...

Post Posted: Nov 08, 10 16:39

... but of investigation interest perhaps to some :

www.macroplant.com/phonedisk/

Free for the time being for both Mac and PC to explore the iPhone directory structure.
_________________
--
Azrael
-- 
 
  

jelle
Senior Member
 

Re: Almost certainly not "forensically sound" ...

Post Posted: Nov 08, 10 17:00

Old discussion, but why not "forensically sound"? The tool will likely change data on the original device, but if you take a conscious decision to use this tool, are aware of the impact and artefacts and take proper notes of what you are doing, why not?  
 
  

azrael
Senior Member
 

Re: Almost certainly not "forensically sound" ...

Post Posted: Nov 08, 10 17:13

<sigh> Ok, that'll teach me to type "quick notes" before thinking ... </sigh>

<takes deep breath and rephrases post as>
This tool is not a traditional forensic tool, is not written by forensic programmers (please see other posts) and is not accredited in any way for forensic use, and thus ( like all tools should be, accredited, forensic or otherwise ) should be verified as to it's behaviour, alteration caused and accuracy. If you fail to do so, may plauges of locusts visit your crops, may you be buried at low tide etc. etc. etc. You have been warned.
</tdbarpa>

I think that I'll change my signature to inculde this disclaimer Wink

( You _do_ have a point, however, I think that there is a place and time for everything, and a quick informative note to others isn't it ... )
_________________
--
Azrael
-- 
 
  

jelle
Senior Member
 

Re: Almost certainly not "forensically sound" ...

Post Posted: Nov 08, 10 17:30

Haha, thumbs up for your reply Wink

I think there is definitely always a time for quick notes/ideas/links and these should of course not have to come with a ten-page disclaimer - however the fact that you were so clearly referring to "forensically sound" (which I really think is a term that is often mis-used or misunderstood) in your subject triggered me Smile We as an industry should try to avoid the dogma that there is something as a "forensic approval" for tools or a "forensically accepted" method in which they work; if there's a need for a tool and you think you can justify its use -> go ahead.

I realise I'm preaching to the choir and that this was also not what you meant by your subject line, but there might be other readers of your quick note who misinterpret the subject line as a sort of disapproval of the use of this tool.  
 
  

azrael
Senior Member
 

Re: Almost certainly not "forensically sound" ...

Post Posted: Nov 08, 10 17:43

- jelle
Haha, thumbs up for your reply Wink


Thanks Smile

- jelle
I think there is definitely always a time for quick notes/ideas/links and these should of course not have to come with a ten-page disclaimer - however the fact that you were so clearly referring to "forensically sound" (which I really think is a term that is often mis-used or misunderstood) in your subject triggered me Smile We as an industry should try to avoid the dogma that there is something as a "forensic approval" for tools or a "forensically accepted" method in which they work; if there's a need for a tool and you think you can justify its use -> go ahead.

I realise I'm preaching to the choir and that this was also not what you meant by your subject line, but there might be other readers of your quick note who misinterpret the subject line as a sort of disapproval of the use of this tool.


You are absolutely right, and I must admit that it was a careless use of language on reflection. I, for one, often forget the impact of the forum on the readers, what I intend to be a throwaway line ends up being interpreted in all sorts of ways - some of the wonderful flame threads we've had here over the years show that I'm not the only one ! Wink

For all of you that have read this far, I neither endorse, nor reject this tool. A friend of mine pointed me at it just now, and I thought that it merited enough interest to pass on here. My subject line was meant to indicate that I had no knowledge of it's behaviour, particularly with regard to the preservation of evidence, and thus it should be treated as an unknown until such time as it has been verified. Jelle is absolutely right, that _any_ tool, given the correct handling can be useful, so long as you know what you are doing, and accept the limitations. My genuine thanks go for making this clearer.
_________________
--
Azrael
-- 
 
  

4Rensics
Senior Member
 

Re: Almost certainly not "forensically sound" ...

Post Posted: Nov 08, 10 18:29

If I were you Azrel I would reject the tool! Its epic fail, literally! It just craps out as soon as I try to run it, gives me the standard windows error log screen!

Has anybody managed to run it?  
 
  

azrael
Senior Member
 

Re: Almost certainly not "forensically sound" ...

Post Posted: Nov 08, 10 18:38

I have - works fine on Windows 7 Ultimate 64-bit, HP 6530b 3Gb & iPhone 3G ( ok, I know the shame, but I had to keep my unlimited data plan, ok ? ), oh and you need iTunes 9 as well I seem to recall ?

It adds itself into the task bar where it sits and intercepts the iPhone plugin action.


_________________
--
Azrael
-- 
 

Page 1 of 3
Page 1, 2, 3  Next