iPhone Forensics

OS X FORENSICS

Please aid in some research that I'm conducting on iPhone Usage.

Question from Techno Forensics Conference

Have to encountered Picture Safe?

After using this application, I found that it is not so safe, (Great for Investigators and Examiners). The passcode is in plain text in the com.collect3.picturesafe.plist and the images are not encrypted very readable. All located in the Logical backup, again no need to jailbreak!

Picture Vault

That is another story, all the images are placed in readable folders, however the images themselves are encrypted.

iPhone Forensic Issues & Ethics

Out in the wild are two methods of iPhone forensics:

1. Create a MobileSync database from an unlocked phone. There are numerous command line and GUI tools that can parse the wealth of data found in this backup. 3.0 gives us a wealth of information that far exceeded our expectations. This is the only method that is legally sound and uses acceptable forensic methods.

2. Jailbreaking the iPhone OS X. However, this method is not forensic and hasn’t been accepted in a court of law in the United States. In fact, this method violates US Copyright Laws:

§ 506 · Criminal Offenses

Criminal Infringement.— (1) In general.—Any person who willfully infringes a copyright shall be punished as provided under section 2319 of title 18

§ 2319. Criminal infringement of a copyright

Any person who violates section 506 (a) (relating to criminal offenses) of title 17 shall be punished as provided in subsections (b), (c), and (d) and such penalties shall be in addition to any other provisions of title 17 or any other law.

First offense 5 years, and every subsequent offense 10 years.

Made on a Mac

Main Navigation