5

How do I mount my iphone to look at it's files forensically? I have FTK Imager (the only free program I could find) but it doesnt mount it as a drive and I can't seem to take a forensic image of the iphone. I am looking to get the cell tower logs (Cells.plist) file and I cant find a program or method to do it.

The phone is not jailbroken and I do not want to do so. I have tried FTK on the windows PC with no luck. I have tried many things on my mac but no dice. Moreover, I cant seem to get the iphone to display in 'devices' on the mac either (although the Iexplorer program works but just not accessing the real good files).

What am I not understanding here? Is there a way to take an image of the iphone itself (and not just its storage partition)?

Edit: Tools like Oxygen, AccessData, Encase, etc supposedly allow the more in depth analysis (such as the cell tower logs) but I cannot find a solution that is not thousands of dollars! Also, Oxygen has a 'free' version but that only allows access to the crap you can find with Iexplorer anyway...

Improve this question

2 Answers 2

Reset to default
3

You can try with iFunBox or iExplorer, but the really juicy stuff isn't available that easily. Most forensic tools go through a process which involves having the iPhone do a backup through iTunes, and then the tool will analyze the files stored in the backup.

Without having forensic tools available, you can try one of many tools like this: https://code.google.com/p/iphonebackupbrowser/

This will let you browse the files inside the backup. Realize that everything might not be available because Apple is the gatekeeper. They decide what files to stuff into the backup.

Edit: You cannot think about an iOS device as a drive. Android works as a drive because its design allows for us to grab a drive image. iOS is designed to only allow you access to what they decide you should.

There are many forensic tools that support physical acquisition***.
http://elcomsoft.com/eift.html (see the chart at bottom)
http://www.oxygen-forensic.com/en/compare/devices/software-for-iphone (statements at bottom)
http://www.cellebrite.com/mobile-forensics/capabilities/ios-forensics (expand support section at bottom)
All of these tools have exceptions that state you cannot acquire a 4S or newer. There is an exploit in the non-updatable bootloader code on the 4 that allows physical acquisition, otherwise it would be a no-go as well.

You can read through Apple's security design and see why we have such difficulties. http://images.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf

The iTunes backup is the most forensicly sound method of acquiring data from iOS because it uses the phone to do what it is programmed to do naturally.

Improve this answer
8
  • I havent tried this one yet, but I will... My question is really what are those forensic tools... I know how to do forensic examinations on all sorts of other 'drives' (to include android) but I am simply having difficulty in attaching IOS in any meaningful way to a traditional forensic imager (like FTK). Another way to approach this question would be to essentially ask how someone actually developed the jailbreak hack -that is, how did they gain access to the root level on a locked device?
    – Matthew Peters
    Apr 14, 2014 at 15:35
  • 1
    The jailbreak hacks are the exploitation of vulnerabilities.
    – Rory Alsop ♦
    Apr 14, 2014 at 16:34
  • True, I'm not all that familiar with the specifics of jailbreaking but you're right in that regard. Nonetheless, there should be a method to essentially image the entire phone and perform an analysis on that (I understand that much of the 'goodies' will be encrypted by Apple, but tools like Oxygen claim to do exactly what I am asking).
    – Matthew Peters
    Apr 15, 2014 at 12:41
  • 1
    The only method for physical acquisition that was not from a proprietary tool was only made available to law enforcement by author's choice. This method doesn't work anymore, so I think you are faced with commercial tools. Forensics has never been a cheap industry. If you can't live with answers like this, you will have to go directly to the makers of these tools and ask them.
    – WMIF
    Apr 15, 2014 at 18:05
  • 1
    @MatthewPeters, Here is your best bet with current generation iOS devices. This PDF is for mitigating leakage, but it talks about the issues enough for you to google them. It has been all over the twinternet lately. strozfriedberg.com/wp-content/uploads/2014/08/…
    – WMIF
    Aug 15, 2014 at 20:14
0

What you are wanting to do is a relatively complex set of actions. That the tools to do this cost money should not be a surprise.

You can try the two WMIF mentions, but they obviously have limitations.

In order to acquire a forensically sound image, you need to use proper forensic tools. Some cost a lot because they have to follow strict rigour in order to be considered as trustworthy by law enforcement or legal systems, others just have a pricing model that reflects demand.

Improve this answer
3
  • I understand the supply and demand model of these tools but I do not understand why it is so difficult to simply 'take an image' of the iphone. It is physically here and attached. Are the tools that can do it simply using some proprietary secret method of accessing the files? All I am looking for is to get the image of the iphone, I will do the examination myself. Similar to FTK and AccessData, the paid tools simply make it easier to do analysis. They do not actually block you from doing it yourself.
    – Matthew Peters
    Apr 14, 2014 at 16:53
  • Because it is designed to stop you doing that. Deliberately. In order to protect most users.
    – Rory Alsop ♦
    Apr 14, 2014 at 17:17
  • I know but obviously it can be done and that is what I am asking -how?
    – Matthew Peters
    Apr 15, 2014 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .