Notifications
Clear all
Topic starter
21/07/2015 7:33 am
I have a logical extraction of an iPhone taken with UFED which is encrypted. I have the password and can successfully view the data via UFED PA, but I want to run IEF across it as well but there is no prompt from IEF to enter the password.
Am I missing something here or can IEF not deal with the encrypted logical backup?
21/07/2015 2:31 pm
If you know the password, it is easy to decrypt the backup (e.g. with Elcomsoft Phone Breaker) and then use IEF to analyze the decrypted copy.
Topic starter
22/07/2015 11:02 am
Unless I'm missing an option here EPB can't use a UFED logical extraction, it needs an iTunes backup folder to work from doesn't it?
I ended up dumping the file system from UFED then running IEF across that. It hasn't finished parsing yet but what I've seen so far seems to be working.