Hey all,
I couldn't find the answer anywhere else..
I have a friend who's child is missing - before she left she did the erase all on her iPhone 4. The police were able to retrieve some iMessages but were in garbled format. The only backup to the phone is about a year old and on the computer. Her cloud was either deleted or never used to backup the phone.
My question is if one were to use the backup on the phone would you be able to retrieve any "newer" information, iMessages, etc.. I don't think the phone has been restored yet but the police have returned it back to the parents.
I use Cellebrite to acquire. Figured it wouldn't hurt to ask as the investigation into her has come to a screeching halt.
Thanks for any info,
Adam
Aquire physical dump with elcomsoft iOS toolkit and search for plain text in the dump and you can do raw recovery with winhex for another file types
So do I need to do the year old recovery first on it? I am assuming that any info wasn't able to be accessed because of the key being encrypted when the device was wiped…
You have Cellebrite UFED, acquire the physical dump with Physical Analyser software and see what (if any) information PA can decode.
Also parse the .bin file with Xways or EnCase (depending what you have available) and if you don't have Magnet Forensics IEF then I highly recommend contacting them and arranging for a 15 day trial and running that software across the .bin file as well.
You will be surprised at the amount of information that you will still recover using these methods despite the existence of any encryption or the like.
Ok thank you! I guess I don't know if I should have them restore the phone first before sending it to me as their State Police were unable to decipher iMessages on the device. I would assume they are using Cellebrite but can't confirm (IL State Police).
I am all for trying without the restore process and using whatever software I can find just didn't know if someone had any luck restoring an older backup and finding anything from the time it was backed up to present day.
Adam
