I-Phone examination: Question of legality & best practice

dunk,
I have had it on good authority that,password protected iphones have to be flashed (therefore ridding it of all info etc) then op system re put to make the phone as it was when it came from the shop.
so at the mo it would appear there is not a lot you can do with such a phone, even attempting the password incorrectly 5 times wipes the phone completely

I have had it on good authority that,password protected iphones have to be flashed (therefore ridding it of all info etc) then op system re put to make the phone as it was when it came from the shop.

Wait are we talking a passcode on the iPhone? If so, then it does not have to be flashed in order to bypass this.

Jonathan Zdziarski has been producing scripts/tools for imaging iPhones for a while now. If you are LE you can get access to the tools for free.

http//www.zdziarski.com/

Tom

I haven't had to examine any Iphones yet (believe it or not…), so I cannot personally vouch for this, but thought I'd share anyway

http//www.iphoneinsecurity.com/

Hope it helps.

Joe

I haven't had to examine any Iphones yet (believe it or not…), so I cannot personally vouch for this, but thought I'd share anyway

http//www.iphoneinsecurity.com/

Hope it helps.

Joe

Yeah that's Zdziarski's other website.

Tom

Hi all.

CdtDelta, yep, it's the handset passcode I'm stuck with.

Basically, it's an 8GB i-Phone, with no SIM. Just a bit concerned about using any of the multitude of suggestions out there regarding methods to access the device, and running the risk of adding data to the handset etc when there has got to be a way to avoid it(?) during the access/extraction process.
It's only the second i-phone I've had to examine, so it's still very much in the "grey areas" of how to extract from 'problematic' devices.
I will certainly have a look at Jonathan Zdziarskis site with view to trying to obtain his software, sounds promising.
To Bigjon and Jmech, thanks too for your input. Much appreciated.

Regards.
Dunk.

CdtDelta-we must have been typing at the same time, I didn't see your post when I wrote mine… D

Dunkjt74-here's a link to a little article that you may find useful in reference to mobile forensics…

http//www.mobileforensicsinc.com/files/DG_Doc.pdf

I used Zdziarski's scripts before he made them LE only, and they worked REALLY well. Especially since you could image it over USB. But the tools I have now are out of date since they've updated the OS. Pretty much once you have the dd image you can throw anything at it. And the passcode unlock does work.

Note If you are non-LE you can get the tools, but you have to put together a training class for at least 10 people and then you get access (no idea on the costs). That's what Jonathan told me when I asked him about it.

Tom

[grr put can't instead of can….need more coffee]

Another way round the pin code issue is to analyse the iphone back up file itself (providing you have the computer it's been synced to). Using tools like this

http//www.reincubate.com/labs/iphone-backup-extractor-how-extract-files-iphone-backup-windows/#/res/i/labs/iphonebe/3_wizard.png

enables you to bypass the pin issue.

Glen

Dunk,

I have been doing a hell of a lot of iPhone research so can help you.

I think the whole idea about not altering user data is slowly growing old. As investigators we have to make decisions about best evidence and how we obtain it.

Apply the idea of a crime scene in real life… If a murder has taken place and the body is still in situ I would have to enter the scene to retrieve the body and take samples etc. In doing so I would contaminate the scene but this is acceptable to me as the end justifies the means. This is completely different to going into the crime scene and moving the body around or moving a discharged shell casing, these are massive changes which could alter my interpretation of the crime.

I guess what I am trying to say is that by jailbreaking the phone you are indeed changing the device however this doesn't mean that the information contained on it that is of relevance is no longer of use. It is an acceptable change to enable you to recover evidence. As long as you have sound rationale you should be ok.

The tools available at iphoneinsecurity.com are fantastic! I use them all the time and they are very easy to use. I dunno if you are a law enforcement officer or from a private firm but either way if you want any more advice PM me and I will give you my Skype details and we can chat about your specific concerns out of band.