Join Us!

iPhone 3G and memor...
 
Notifications
Clear all

iPhone 3G and memory size problem?  

  RSS
sideshow018
(@sideshow018)
Member

The findings are a bit long to post here but the just of it is

I am working on an Iphone 3G 8GB; it required the chipoff process; examined the chip and determined the size to be 64 GB, not 8 GB as indicated by the iPhone; found same in other iPhone 3G phones; completed a read and got data from the full chip dating back a few years……..more detials at

http//copgeek018.wordpress.com/

Looking for some help from Chipoff and iPhone experts to figure this one out.

Thanks,

Bob

Quote
Posted : 29/05/2011 6:06 am
trewmte
(@trewmte)
Community Legend

What does that mean, well the Chipoff process is recovering 56 GB of unallocated data that the physical tools are not getting at. The tools are indicating that they are doing a full physical read when in fact they are only reading 8GB of 64 GB. During the analysis of this iPhone, I am recovering data throughout the chip read and some of the user data dates back 3 years including SMS text, internet history, emails and call logs.

This is a very important point you are qualifying here. It is one aspect of a very, very, very wide ranging and long term discussion about examiners needing to be aware about the tools they use and what they do and don't and how they perform.

ReplyQuote
Posted : 29/05/2011 2:18 pm
Jonathan
(@jonathan)
Senior Member

What does that mean, well the Chipoff process is recovering 56 GB of unallocated data that the physical tools are not getting at. The tools are indicating that they are doing a full physical read when in fact they are only reading 8GB of 64 GB. During the analysis of this iPhone, I am recovering data throughout the chip read and some of the user data dates back 3 years including SMS text, internet history, emails and call logs.

This is a very important point you are qualifying here. It is one aspect of a very, very, very wide ranging and long term discussion about examiners needing to be aware about the tools they use and what they do and don't and how they perform.

I think what's more interesting than the methodology for most people here Greg is the fact that iPhones and iPads, whatever their stated size, appear to actually have at least 64GB in capacity. 😯

Thanks to Bob for publishing your findings, fascinating.

ReplyQuote
Posted : 29/05/2011 3:32 pm
trewmte
(@trewmte)
Community Legend

I think what's more interesting than the methodology for most people here Greg is the fact that iPhones and iPads, whatever their stated hingsize, appear to actually have at least 64GB in capacity. 😯

Well, maybe o .

If I raised an analogy to computer forensic experts I wonder if they would think about the discovery that an HDD had more memory than detected by EnCase is more important or perhaps think the preferred tool of use has missed potential evidence and how many past and present cases might be affected by that?

I think that most people do want to know of the limitation of the tools they use Jonathan in order to take appropriate action. In fact the matter came up again recently in a criminal investigation and how much physical data may be recovered from iPhones.

Just a wild, crazy thought, but what about (mentioned on FF previously) getting a spec sheet for the memory device and determine eg '64GB memory but the tool I use only recovers 8GB or less…what evidence might be missed? No?

ReplyQuote
Posted : 29/05/2011 4:31 pm
Jonathan
(@jonathan)
Senior Member

I absolutely agree with your original point Greg, that the examiner needs to be aware about the tools they use and what they are and aren't capable of.

However few cases call for a truly exhaustive examination of submitted media; we usually have specific criteria to complete within an agreed number of hours. The defendant may say that there's exculpatory evidence in unexamined/unexaminable areas, but I'd be interested to know how often that argument has successfully negated existing evidence.

ReplyQuote
Posted : 29/05/2011 5:12 pm
sideshow018
(@sideshow018)
Member

Thanks for the feedback guys, appreciate it. I have posted this on some list servs and getting information back as time goes on. What has been brought up so far is the datasheets and measurements that needs to be figured out. From there, I will have to work with the programmers and manufacturers to see why I am getting these reads from the chip. Based on the feedback so far, I will have to put more work into this and do some more indepth validations. Working out puzzles like this, is what makes this job great (-

ReplyQuote
Posted : 29/05/2011 10:22 pm
Share: