Cellebrite UFED Physical will soon support physical and file system extraction on locked iPhone and iPad including iOS 4.x
How long will it be before this is implemented?
Thanks
For related UFED discussion see http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&t=7091
http//
Will cover iPad soon.
Cellebrite UFED Physical will soon support physical and file system extraction on locked iPhone and iPad including iOS 4.x
So you are able to take a dd image of the iPad running iOS 4.2x?
This is interesting as the JZ tools are not able to do this. Can you confirm a time scale for when this will be available?
Will there be any need for files from the host computer in order to perform this recovery or to bypass passcodes?
Doug,
Yes, we dump the iPad iOS 4.2.x
We will support more versions the JZ tools
You will not need any files from the host computer
BTW, the physical dumps on iOS4 is encrypted on devices that came with iOS 4 preinstalled / have been restored with iOS4. In such cases we bypass the encryption by performing a file system dump (will work on locked devices too).
Doug,
Yes, we dump the iPad iOS 4.2.x
We will support more versions the JZ tools
You will not need any files from the host computer
BTW, the physical dumps on iOS4 is encrypted on devices that came with iOS 4 preinstalled / have been restored with iOS4. In such cases we bypass the encryption by performing a file system dump (will work on locked devices too).
So, just to get my head around this. This will extract data from an iPad, that is locked and encrypted and can I assume that it does not have to be jailbroken too? This would be great for an off the shelf product. Will it extract emails? At present, even with passcodes, you still can't easily extract emails on i[insert device here]'s
Indeed, even if it is locked and encrypted.
It does not have to be jailbroken.
I will check regarding emails and update.