The phone and the case are a few years old hence working on an iPhone 4. I know the passcode to the phone so that's no problem.
There are a lot of apps on the device such as Whatsapp, Viber, WeChat, Facebook, Twitter, etc.
I've obtained a logical acquisition of the device and examined it in a number of programs, namely IEF, EnCase and XRY. I set them to examine and organise artifacts found from the relevant apps, however in the analysis results most of the apps are missing.
I have all the records for Whatsapp, and all the SMS records, photos, etc. But MOST of the third party apps are totally missing.
I went into the device and when I try to open any of the apps that are missing such as WeChat and Viber they fail to load. They appear to open for a second but then it immediately returns to the home screen. I'm certain there's a lot of data in those apps but there's no way to access it that I have found yet either through acquisition or thumb forensics.
Can anyone help shed some light on this and any solutions?
Could it be that as the phone is now signed out from itunes/icloud and can't connect, and perhaps the apps have been logged out from remotely or otherwise they will not load? Does anyone know if these apps are encrypted when logged out?
Did you do a physical memory dump?
Did you do a physical memory dump?
It's an iPhone 4 on iOS 7, only logical acquisition is available as it's not jailbroken.
Nope, you can do a physical on iPhone 4.
4s and above you cant do physical unless jailbroken.
Nope, you can do a physical on iPhone 4.
4s and above you cant do physical unless jailbroken.
With what tool can you do that?
I was using Magnet Acquire and the only option available to acquire the phone is a quick logical of native and third party apps.
With what tool can you do that?
Elcomsoft iOS Forensic Toolkit, UFED Physical Analyzer, etc.
XRY / UFED