I wanted to recover with foremost or scapel the a girlfriends iPhone 4, because she had deleted all the videos of her daughter.
What I have got:
- A backup of the iPhone with iTunes without password.
- DD image of rdisks0s1 16 GB mountable on Linx. Everything is there.
- A copy of all files with WinSCP uncrypted. System.kb ... phone was jailbreaked and DFU mode and with an early verison of the Geckotool.
- deviceinfos (EMF,dataVolumeUID,key835,key89A,key89A,...)
- Keychain decrypted
What I havent got:
- I cant bring the thinks togehter and I gave back the phone, because she needed it.
- When I try to run iphone_Dataprotection EMF_decrypt it says "Keybag locked". Is there a way to unlock the keybag without the IPhone? In the tool I used was not the command to bruteforece. Just the possibiltiy to mount the filesystem to mnt1 & mnt2 and device infos.
Is here somebody who can show me a way to decrypt the image?