Notifications
Clear all

iPad investigation

24 Posts
13 Users
0 Reactions
2,424 Views
chloroform87
(@chloroform87)
Active Member
Joined: 15 years ago
Posts: 7
Topic starter  

Hi there,

I'm currently trying to extract data off of an iPad A1337…unfortunately XRY isn't picking it up and Cellebrite is saying I need to update the image to v1.0.2.2

I've tried finding the image update but can't seem to get hold of it anywhere..I don't know if its just me being dippy or if they have actually released it yet? As for the XRY does anyone know why that won't be recognising the device?

Also to add when I attach it to the computer it appears as a digital camera, would this have something to do with my lack of luck?


   
Quote
Logan
(@logan)
Trusted Member
Joined: 15 years ago
Posts: 66
 

What version of XRY are you running? It is pretty unusual for XRY not to identify an Apple product…


   
ReplyQuote
Logan
(@logan)
Trusted Member
Joined: 15 years ago
Posts: 66
 

Also, and I know this sounds silly, but make sure you are selecting 'Apple' when searching for the device, rather than 'Cable'.


   
ReplyQuote
chloroform87
(@chloroform87)
Active Member
Joined: 15 years ago
Posts: 7
Topic starter  

I'm running XRY v6.0.2

Yeah I've been selecting Apple and it comes up with no device detected!


   
ReplyQuote
Logan
(@logan)
Trusted Member
Joined: 15 years ago
Posts: 66
 

How strange! Have you tried selecting by model? i.e. manually selecting the iPad rather than letting XRY find it itself?


   
ReplyQuote
chloroform87
(@chloroform87)
Active Member
Joined: 15 years ago
Posts: 7
Topic starter  

Yep tried that and all!

Windows is picking the iPad up but XRY isn't….

Do you know of any other options of how to image it on either XRY or Cellebrite?


   
ReplyQuote
Logan
(@logan)
Trusted Member
Joined: 15 years ago
Posts: 66
 

If the applications are not picking it up, then no unfortunately. Try another work station?

You should be able to use Elcomsoft or the Jonathon Zdziarski technique to image the iPad, and also get a full read of the file system if XRY is not working. Havent tried using Cellebrite


   
ReplyQuote
(@crashed)
Active Member
Joined: 15 years ago
Posts: 14
 

Have you tried Oxygen Forensic Suite 2011 verison 3.7.0.1. It has only just been released.


   
ReplyQuote
Logan
(@logan)
Trusted Member
Joined: 15 years ago
Posts: 66
 

Check this out as well

http//www.apple.com/support/ipad/assistant/itunes/


   
ReplyQuote
 RonS
(@rons)
Reputable Member
Joined: 17 years ago
Posts: 358
 

chloroform87

Why aren't you using Cellebrite UFED PA.
As a UFED user you have a 30 day trial of UFED PA that has also physical support (that can also bypass locked iDevices) and also supports the latest iOS5 encryption.

Check the latest UFED PA iOS user manual for more information
http//www.ume-update.com/UFED/iOS_User_Manual.pdf

RonS


   
ReplyQuote
Page 1 / 3
Share: