Jailbreaking using jailbreakme.com for defence exam

Jailbreaking a iPhone will alter the user data slice in ways that are undocumented and not fully known. If you jailbreak the phone you are running a risk of acquiring non admissible evidence. If you do jailbreak it without the other side's agreement they could make a motion for spoliation of evidence.

Why not use the Zdziarski method? It is a forensically sound method and does not alter either slice (partition) on the iPhone. I'm not sure if he has one for the iPhone 4 yet but he's always ontop of new releases.

# Subject APPLE-SA-2010-08-24-1 Security Update 2010-005
# From Apple Product Security <email@hidden>
# Date Tue, 24 Aug 2010 130545 -0700

http//lists.apple.com/archives/security-announce/2010/Aug/msg00003.html

Jailbreaking a iPhone will alter the user data slice in ways that are undocumented and not fully known. If you jailbreak the phone you are running a risk of acquiring non admissible evidence. If you do jailbreak it without the other side's agreement they could make a motion for spoliation of evidence.

Why not use the Zdziarski method? It is a forensically sound method and does not alter either slice (partition) on the iPhone. I'm not sure if he has one for the iPhone 4 yet but he's always ontop of new releases.

Sadly he has not released anything for the iPhone 4 or iOS4 yet.

I am not holding out too much hope for future releases as each release is taking longer and longer to get out.

Hasn't the last ios4 patch plugged the PDF exploit?

That's version 4.0.2 I believe, the OP's handset is still a point version behind (luckily).

Yes, 4.0.2 did. But the phone was seized before that was released.

Also, just because the latest version is out doesn't mean everyone runs it, I know I don't so I can keep my jailbreak! )

I would suggest the Zdziarski Method found on www.iphoneinsecurity.com. We use this method to create a forensic image that we then examine with Encase. We find much more information from this sort of exam versus Cellebrite, Paraben, Device Seizure, etc.

I would suggest the Zdziarski Method found on www.iphoneinsecurity.com. We use this method to create a forensic image that we then examine with Encase. We find much more information from this sort of exam versus Cellebrite, Paraben, Device Seizure, etc.

Jailbreaking a iPhone will alter the user data slice in ways that are undocumented and not fully known. If you jailbreak the phone you are running a risk of acquiring non admissible evidence. If you do jailbreak it without the other side's agreement they could make a motion for spoliation of evidence.

Why not use the Zdziarski method? It is a forensically sound method and does not alter either slice (partition) on the iPhone. I'm not sure if he has one for the iPhone 4 yet but he's always ontop of new releases.

Sadly he has not released anything for the iPhone 4 or iOS4 yet.

I am not holding out too much hope for future releases as each release is taking longer and longer to get out.