IPhone Forensic Extrction

  • We encourage our users to use Real Names to build a real community, friendships and networking opportunities.

    [more information]

Status
This thread has been solved! Go to solution…

redneckcop

New Member
Jul 23, 2009
12
0
#5
ana said:
How would I go about acquiring forensics data from and IPhone 5? :?: :?:
iTunes is a pretty decent tool, believe it or not, if you want to take a backup of an iPhone's contents and preview it. It backs up other stuff on the phone besides music, which surprised me at first. It doesn't seem to do a sector by sector backup though, at least not that I have observed .
 

rww

New Member
Nov 1, 2018
3
1
#6
There are a number of tools available to do this. However unless you are a sworn official most of the companies will not sell the software and cables needed to do this type of extraction.
 

twicesafe

Administrator
Staff member
Sep 4, 2018
75
Ratings
13
8
Vancouver, Canada
www.computerforensicsworld.com
Twitter
Forensic_Notes
#7
@rww makes a valid point in that some software is only available to law enforcement.

When posting questions, please be sure to include:
1. Where do you work?
2. Why do you want to do the action you are asking?
3. Type of device, including version.
4. State of the phone. (locked..PIN, Password, etc. or unlocked)


SANS Institute often provides excellent white papers on Digital Forensics. This one produced back in 2012 would be valid for an iPhone 5. It discusses acquisition on page 6.

SANS Institute: Reading Room - Forensics
[Download]
 

azuleonyx

Member
Experienced Member
Oct 20, 2018
31
Ratings
25
18
Charlotte, North Carolina Area
cyberfenixtech.blogspot.com
Twitter
https://twitter.com/AzuleOnyx
#8
iTunes is a pretty decent tool, believe it or not, if you want to take a backup of an iPhone's contents and preview it. It backs up other stuff on the phone besides music, which surprised me at first. It doesn't seem to do a sector by sector backup though, at least not that I have observed .
No, iTunes does not do a sector by sector backup. iTunes is probably the best non-commercial tool depending on what you are trying to do. Just note depending on iTunes configurations, you may not get everything sync'd to the cloud. Also, having the computer which was used for the iPhone would help in getting any automatically phone backups instead of trying to pull your own.

Outside of the SANS Institute above, other tools can be located at Apple iPhone - ForensicsWiki. However, in any case, make sure you have legal rights to examine the phone before attempting any forensics on it.
 

Randomaccess

New Member
TRUSTED Contributor
Oct 27, 2018
4
Ratings
9
3
#9
There are a number of tools available to do this. However unless you are a sworn official most of the companies will not sell the software and cables needed to do this type of extraction.
That's not exactly true

There's a couple of tools that you can use to perform this type of extraction (Belkasoft's BAT and Magnet Acquire both are free tools for it). And the cable for an iPhone extraction is a standard iPhone cable.

Parsing the data; paid tools generally do a more comprehensive job, but you can manually examine the extracted data using something like ibackupbot, a plist viewer, and an sqlite viewer with the right queries
 

rww

New Member
Nov 1, 2018
3
1
#10
That's not exactly true

There's a couple of tools that you can use to perform this type of extraction (Belkasoft's BAT and Magnet Acquire both are free tools for it). And the cable for an iPhone extraction is a standard iPhone cable.

Parsing the data; paid tools generally do a more comprehensive job, but you can manually examine the extracted data using something like ibackupbot, a plist viewer, and an sqlite viewer with the right queries
Fair...but notice that I said "most of the companies"....did not say "all of the companies".
 

Randomaccess

New Member
TRUSTED Contributor
Oct 27, 2018
4
Ratings
9
3
#11
Fair...but notice that I said "most of the companies"....did not say "all of the companies".
I'm only aware of one company, grayshift, that won't sell to non law enforcement. All the others work with both LE and non LE.
Which other companies will only sell phone extraction tools to LE?
 
Status
This thread has been solved! Go to solution…

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu