Apple iPhone 5 & 6 Encrypted Backup

I assume you are not in LE? Jailbreaking a phone would make your evidence highly questionable.

This is true, modifying an evidence is the last resort and needs approval from the LE leader in charge or a judge's request to do so.

When jailbraking a phone, there are uncontrolled operations happening in the background. No matter how well you document the process, there could be things which you won't ever know about, for example a script installing spyware/malware or compromising the user data in any other way.

The policy which should be followed is to extract (forensically documented) the relevant data without ANY modifications of the original content.

I assume you are not in LE? Jailbreaking a phone would make your evidence highly questionable.

This is true, modifying an evidence is the last resort and needs approval from the LE leader in charge or a judge's request to do so.

When jailbraking a phone, there are uncontrolled operations happening in the background. No matter how well you document the process, there could be things which you won't ever know about, for example a script installing spyware/malware or compromising the user data in any other way.

The policy which should be followed is to extract (forensically documented) the relevant data without ANY modifications of the original content.

Do agree with this, and jailbreaking would only be carried out as a last resort, with the obvious authorization. The same goes for rooting a device. In terms of recovering data without ANY modifications, that is a different debate entirely. Even forensic software has to upload agents etc.

However, the point of the initial question was to see IF anyone has been successful obtaining the iTunes encryption passcode by jailbreaking, or if anyone has recovered data from encrypted backup devices this way. Yes the data can be recovered manually, but what if there is deleted data which may be crucial to the case?

LE can also approach Cellebrite CAIS services to unlock iOS devices (and Android devices)

If you are referring to an iTunes' encryption password that is in place on the iPhones, then here are some options

2) Compelson MobilEdit Forensic Express (http//www.mobiledit.com/online-store/forensic-express) US $1,200.00

OPTION 3 Compelson MobilEdit Forensic Express can be used to crack the iTunes password of the iPhones directly (not the mobile backups of the phones).

++

Slight correction to Unallocated Clusters post…

With MOBILedit Forensic Express you can gain access to locked backups of a phone by using the password and PIN breaker. This applies to encrypted iTunes backups that are imported to the machine, and those backups already in a live connected phone. Passwords can be cracked by performing a dictionary attack using the built-in dictionary, or you can use your own dictionary for other languages. Password breaker uses GPU acceleration and multi-threaded operations for maximum speed.

Hey all,

I have an Apple iPhone 5 and 6 which both require an encrypted backup password. I have the passcodes for the device, but not the backup password. As forensic software is unable to recover calls, SMS, social networking messaging data etc, i was wondering if anyone has attempted to jailbreak these devices in the past in order to recover these files?

Any thoughts??? D

Have you tried Oxygen Forensic Detective? We have special Passware module inside that finds the password to encrypted iTunes backup. The module provides 10 different password recovery attacks with an easy-to-use wizard.