Carving from UFED physical iPhone image

Adam10541 · 2012-06-15T08:22:10Z

Just an issue which is confusing me slightly.I've taken a physical image of an iPhone 4 with UFED PA3. When I run UFED's own picture carving utility it sits there and says initializing for a few seconds, then nothing seems to happen. I can't see any indication that a carving process is running even though the warning states that this might take some time.I noticed the image file was a standard .img format so I reverted to my favorite tool (Xways) and loaded up the image in this and happily Xways interpreted the image file correctly and I can see the file structure of the iPhone as it should be. However, when I use Xways filter to show only picture files I can see the names of the files and the path etc, however the internal viewer for Xways can't render the JPG pictures, they appear garbled.So I guess I have two questions here. Firstly has anyone else had issues with UFED picture carving not working as it should? Secondly anyone had any luck viewing and carving pictures from the .img with other Forensic tools?On a side issue why does the UFED PA software only offer picture carving, why not carve for videos, SMS, email etc etc…?

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by beasleyjt 14 years ago

11 Posts

4 Users

0 Reactions

3,637 Views

RSS

beasleyjt

(@beasleyjt)

Trusted Member

Joined: 16 years ago

Posts: 56

20/07/2012 12:58 am

@ Ron - thank you for the PM.

@ Adam - We do not run any of our tools in a VM. As for the 32/64 bit, we only run 64 bit OS's. I do have the capability of getting a 32 bit WinXP OS to try it on. I will give that a whirl after I try another option I was given.

Thanks all.

ReplyQuote

Page 2 / 2 Prev