I need to acquire the mails stored in an Apple Ipad. The collegue who rent me UFED is not available. What do you suggest me of cheap or free?
thanks
jailbreak
giandega,
Here are some potential file paths to get to email
1) Apple Mail MBOX or Mail Box file containing Apple Mail email and attachments
\Users\*User Name*\Library\Mail\V3\748B5D93-F59C-459A-B38B-B-1712BE6FC87\USER-NAME.MBOX
2) Gmail Gmail will be stored as TXT files under the below path
ROOT]/Users/*User Name*/Library/Containers/
NOTE
The above two examples are from MacBook Pros, NOT iPads, but hopefully will provide you with some guidance of where to look.
Regards,
Larry
giandega,
Here are some potential file paths to get to email
1) Apple Mail MBOX or Mail Box file containing Apple Mail email and attachments
\Users\*User Name*\Library\Mail\V3\748B5D93-F59C-459A-B38B-B-1712BE6FC87\USER-NAME.MBOX
2) Gmail Gmail will be stored as TXT files under the below path
ROOT]/Users/*User Name*/Library/Containers/
com.apple.mail/Data/Library/Logs/Mail/imap.gmail.com-240528E0-B74B-4BF1-9F9F-8CC57545565359.txt NOTE
The above two examples are from MacBook Pros, NOT iPads, but hopefully will provide you with some guidance of where to look.
Regards,
Larry
😯
Depending on the iPad generation, you won't be able to acquire them with ufed/xry or other mobile forensic tool due to the encryption on it. You will need to manually print them to PDF or photograph them. If your not worried about the forensic integrity, as suggested you could jail break it (although how this would work I do not know)
I think on Physical Analyser you can connect your device and take screenshots through the application.
Alternatively you can use QuickTime on a Mac and use the iPad as a camera device.
Then open the relevant emails and take screenshots on the connected computer. Not sure what forensic artefacts it leaves on the device, but it doesn't appear to leave screenshots in the camera roll.
It also beats taking a camera out and photographing the device yourself.
Otherwise your only option to getting email is to either get the creds and sync, or, as Igor said, jailbreak