Notifications
Clear all

mail Apple Ipad

6 Posts
5 Users
0 Reactions
1,005 Views
 dega
(@dega)
Reputable Member
Joined: 11 years ago
Posts: 267
Topic starter  

I need to acquire the mails stored in an Apple Ipad. The collegue who rent me UFED is not available. What do you suggest me of cheap or free?
thanks


   
Quote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

jailbreak


   
ReplyQuote
UnallocatedClusters
(@unallocatedclusters)
Honorable Member
Joined: 13 years ago
Posts: 576
 

giandega,

Here are some potential file paths to get to email

1) Apple Mail MBOX or Mail Box file containing Apple Mail email and attachments

\Users\*User Name*\Library\Mail\V3\748B5D93-F59C-459A-B38B-B-1712BE6FC87\USER-NAME.MBOX

2) Gmail Gmail will be stored as TXT files under the below path

ROOT]/Users/*User Name*/Library/Containers/com.apple.mail/Data/Library/Logs/Mail/imap.gmail.com-240528E0-B74B-4BF1-9F9F-8CC57545565359.txt

NOTE

The above two examples are from MacBook Pros, NOT iPads, but hopefully will provide you with some guidance of where to look.

Regards,

Larry


   
ReplyQuote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

giandega,

Here are some potential file paths to get to email

1) Apple Mail MBOX or Mail Box file containing Apple Mail email and attachments

\Users\*User Name*\Library\Mail\V3\748B5D93-F59C-459A-B38B-B-1712BE6FC87\USER-NAME.MBOX

2) Gmail Gmail will be stored as TXT files under the below path

ROOT]/Users/*User Name*/Library/Containers/com.apple.mail/Data/Library/Logs/Mail/imap.gmail.com-240528E0-B74B-4BF1-9F9F-8CC57545565359.txt

NOTE

The above two examples are from MacBook Pros, NOT iPads, but hopefully will provide you with some guidance of where to look.

Regards,

Larry

😯


   
ReplyQuote
(@dominic-moore373)
New Member
Joined: 10 years ago
Posts: 2
 

Depending on the iPad generation, you won't be able to acquire them with ufed/xry or other mobile forensic tool due to the encryption on it. You will need to manually print them to PDF or photograph them. If your not worried about the forensic integrity, as suggested you could jail break it (although how this would work I do not know)


   
ReplyQuote
(@randomaccess)
Reputable Member
Joined: 14 years ago
Posts: 385
 

I think on Physical Analyser you can connect your device and take screenshots through the application.
Alternatively you can use QuickTime on a Mac and use the iPad as a camera device.

Then open the relevant emails and take screenshots on the connected computer. Not sure what forensic artefacts it leaves on the device, but it doesn't appear to leave screenshots in the camera roll.
It also beats taking a camera out and photographing the device yourself.

Otherwise your only option to getting email is to either get the creds and sync, or, as Igor said, jailbreak


   
ReplyQuote
Share: