IOS
Based on Mac OS X
2 Partitions
Data (Media)
User Data
System (Root)
HFS+ Journaled (Case Sensitive)
iPods can be FAT or XFAT
IOS Devices:
iPod
iPad
iTouch
iPhone
Original iPhone
Released July 2007
8 GB OR 16 GB
32 GB – Feb. 2008
GSM
2G
iTunes v7.3
Only Carrier - AT&T
iPhone
File System Depends on Chip
Solid State Memory
Larger Storage Capacity
Multi-tier Wireless Communication
Bit-stream Memory Image
Marketing Tracking Device
Avg. Memory Capture: 1.4 tb
Type Allocation Code (TAC)
01/241700
Apple
iPhone 4
01/233800
Apple
iPhone 4 model MC610LL
01/233700
Apple
iPhone 4 model MC603B
01/243000
Apple
iPhone 4 model MC603KS
01/300600
Apple
iPhone 4S model MD260C
01/332700
Apple
iPhone 5 model MD642C
iPhone 4S Carriers
Verizon (CDMA)
No SIM Card
Sprint (CDMA)
AT&T (GSM)
C Spire Wireless (CDMA)
iPhone 4S Hardware
Lithium Ion Battery
8MP Camera
1080p Video
Apple A5 Processor
512MB RAM
Storage - up to 64GB
iPhone 4S Changes
Voice Recognition Asst. (Siri)
iCloud
A5 Processor
Now Max. Memory of 64GB
Antennae
Bluetooth 4.0
WiFi
Cellular
Dual Antennae
GPS
iPhone 5 Features
4G LTE
iOS 6
Larger Screen (4”)
Thinner
Lighter (3.95 oz)
A6 Processor
Turn-by-turn Navigation
Smaller Connection Port
Review: http://www.cnet.com/iphone-5
iPhone 5 Carriers
AT&T
Sprint
Verizon
Forensic Tools
BlackLight (Mac and Windows based)
Elcomsoft Phone Password Breaker (Mac and Windows based)
Elcomsoft iOS Forensic Toolkit 1.0.5 (Mac and Windows based)
Cellebrite (Windows based)
AccessData Forensic Toolkit v3 (Windows based)
Oxygen Forensic Suite (Windows based)
iXAMiner (Windows based)
Lantern (Mac based)
iPhone Backup Analyzer (Mac based)
Evidence Acquisition Method
Physical Dump
Logical Acquisition
Manual Examination
Backup (Computer)
Chip-Off
iPhone Backup
Macintosh
~/Library/ApplicationSupport/MobileSync/Backup/
Windows Vista & Windows 7
\Users\
\AppData\Roaming\Apple Computer\MobileSync\Backup
iPhone PList
/private/var/mobile/Library/CallHistory/call_history.db
/private/var/mobile/Library/AddressBook/AddressBook.sqlitedb
/private/var/mobile/Library/AddressBook/AddressbookImages.sqlitedb
/private/var/mobile/Library/Cookies/Cookies.plist
/private/var/mobile/Library/Keyboard/dynamic-text.dat
/private/var/mobile/Library/Mail/Accounts.plist
/private/var/mobile/Library/Mail/(mail account name)/Deleted Messages
/private/var/mobile/Library/Mail/(mail account name)/Sent Messages
/private/var/mobile/Library/Mail/(mail account name)/Inbox
/private/var/mobile/Library/Maps/History.plist
/private/var/mobile/Library/YouTube/Bookmarks.plist
/private/var/mobile/Library/Voicemail/(amr files)
/private/var/mobile/Library/Voicemail/voicemail.db
/private/var/mobile/Library/Safari/Bookmarks.plist
/private/var/mobile/Library/Safari/History.plist
/private/var/mobile/Library/Suspend.plist
/private/var/mobile/Library/Safari/SuspendState.plist
/private/var/mobile/Library/Safari/SMS/sms.db
/private/var/mobile/Library/Preference/
/private/var/mobile/Library/Notes/notes.db
iPhone Backup
SMS & MMS
Photos
Calendar
Call Logs
Voicemail
Notes
Safari History
Map Searches
Third Party Apps
iPhone Modes
Normal
Recovery
Boot the Device into iBoot
Stage 2 Bootloader
Power Button & then Home Button
Device Firmware Upgrade (DFU)
Physical Acquisition
Hold Power & Home Buttons Simultaneously for 10 Seconds
Apple Logo Displays
Terminal
Finder Application
Menu Bar Click Go & then Utilities
Terminal
$ system_profiler | less
/DFU
Jailbreak (Unshackled)
Jonathan Zdziarski
Nerve Gas
Free Tool for Law Enforcement
www.zdziarski.com
Apple Can Assist with Removing PIN/Password
Jailbreak
Software
Jailbreak
iFuntastic
ZiPhone
iLiberty
Jailbreak will often Install an SSH Client
Allow Communication with iPhone
Locked Device
Find Paired Computer & Lockdown File
Mac
/private/var/db/lockdown
Windows 7
C:\ProgramData\Apple\Lockdown
Challenges
Latest OS Impervious to Jailbreak
Remote Wipe (MobileMe)
Xcode
Integrated Development Environment
Create Apps for Mac, iPhone & iPad
Read PList (Property List)
https://developer.apple.com/xcode/
iPod
iPod Shuffle
iPod Nano
iPod Classic
iPod Touch (iTouch)
iPod PLists
Pictures: iPodName/Photos/Thumbs/…
Contacts: iPodName/Contacts/iSync.vcf
Calendars: iPodName/Calendars/iSync-CalendarName.ics
Voice Memos: iPodName/iPod_Control/Music/…m4a
Notes: iPodName/Notes/…rtf
Music: iPodName/iPod_Control/Music/…m4a
Trash: .Trashes/502/FileName.extension
Date/Time/Name: VolumeName/Users/UserName/Library/Logs/iPod Updater Logs/iPodUpdater.log
Serial #: VolumeName/Users/UserName/Library/Preferences/com.apple.iPod.plist
Pictures: VolumeName/Users/UserName/Pictures/iPod Photo Cache/F00/
Additional source: Dr. Darren Hayes
