iPhone Forensics—Analysis of iOS 5 backups: Video
[highlight color="blue"]Interested in formal iPhone forensics training? Check out our 3 day iPhone and iOS forensics course now available. [/highlight]
[highlight color="blue"]Interested in formal iPhone forensics training? Check out our 3 day iPhone and iOS forensics course now available. [/highlight]
Learn Digital Forensics
Learn Digital Forensics
In the first part of this article, we covered techniques for reading iTunes backups. In the second part of this article, we disclosed the procedure to extract protection class keys from the Backup Keybag and covered the techniques and tools for decrypting the protected backup files and the encrypted backups.
The videos listed in this article will demonstrate the iOS 5 backup analysis techniques in a more detailed fashion.
Note: Demos are captured on Mac OS X Lion 10.6 running with iTunes 10.6. iPhone 4 GSM with iOS 5.0.1 is used in the video.
Decrypting the Encrypted iOS backups—Video:
Download [encrypted backup.mp4]
A transcript of the video is available at: http://securitylearn.files.wordpress.com/2012/06/analysis-of-ios-backups-video-transcript.docx
Forensic investigation of the backup files allows an examiner to gain access to the entire contents of his or her host phone up until the point when the backup firt took place. It is also quite possible that the seized system might contain older copies of the backup files or other iPhone backups which may contain an additional wealth of information.
To view the list of available backups on a system, open iTunes and navigate to the Edit->Preferences (on windows) or iTunes->Preferences (on Mac) menu and choose the Devices tab. The screenshot below displays an example list of backups.
iTunes also provides an option for deleting backup files. To delete an existing iPhone backup, in the Devices Preferences window (shown in the screenshot above) select a backup and click on the Delete Backup button. If a backup is deleted from a system, a forensic examiner can use data recovery or carving tools to recover the deleted files from the system hard disk. It is easy to recover the deleted files from the computer when compared with iPhone.
The iPhone stores a lot of user data in the backup files. The following table lists the common sources of potential evidence that can be analyzed in an investigation.
In addition to the files listed above, the iPhone backup system also contains third party application files. Sensitive information stored in the third party application files may also provide possible evidence for an investigation.
Example: Facebook and LinkedIn iPhone applications store the authentication tokens and cookie values in plist files on the device. During backup, iTunes copies the plist files on the device to the backup folder. In such cases, analyzing the backup files gives access to the authentication tokens which in turn allows a user to log into the application without supplying the username and password.
More details about Facebook plist hijacking are documented at: http://blog.scoopz.com/2012/04/11/how-to-hack-facebook-dropbox-linkedin-and-other-ios-apps-using-a-plist-extracted-from-ios-backups/
Learn Digital Forensics
Learn Digital Forensics
Forensic analysis of backup files does not compromise the content on a live device. As a result of this, forensic examiners tend to prefer analyzing backup files to collect evidence even though it is not possible to recover the deleted iPhone data.
Learn Digital Forensics
Build your digital forensics skills with hands-on training in Infosec Skills. What you'll learn- Forensics concepts
- Computer forensics
- Mobile forensics
- Network forensics
- And more
In this Series
- iPhone Forensics—Analysis of iOS 5 backups: Video
- Top 7 tools for intelligence-gathering purposes
- iOS forensics
- Kali Linux: Top 5 tools for digital forensics
- Snort demo: Finding SolarWinds Sunburst indicators of compromise
- Memory forensics demo: SolarWinds breach and Sunburst malware
- Digital forensics careers: Public vs private sector?
- Email forensics: desktop-based clients
- What is a Honey Pot? [updated 2021]
- Email forensics: Web-based clients
- Email analysis
- Investigating wireless attacks
- Wireless networking fundamentals for forensics
- Protocol analysis using Wireshark
- Wireless analysis
- Log analysis
- Network security tools (and their role in forensic investigations)
- Sources of network forensic evidence
- Network Security Technologies
- Network Forensics Tools
- The need for Network Forensics
- Network Forensics Concepts
- Networking Fundamentals for Forensic Analysts
- Popular computer forensics top 19 tools [updated 2021]
- 7 best computer forensics tools [updated 2021]
- Spoofing and Anonymization (Hiding Network Activity)
- Browser Forensics: Safari
- Browser Forensics: IE 11
- Browser Forensics: Firefox
- Browser forensics: Google chrome
- Webinar summary: Digital forensics and incident response — Is it the career for you?
- Web Traffic Analysis
- Network forensics overview
- Eyesight to the Blind – SSL Decryption for Network Monitoring [Updated 2019]
- Gentoo Hardening: Part 4: PaX, RBAC and ClamAV [Updated 2019]
- Computer forensics: FTK forensic toolkit overview [updated 2019]
- The mobile forensics process: steps and types
- Free & open source computer forensics tools
- An Introduction to Computer Forensics
- Common mobile forensics tools and techniques
- Computer forensics: Chain of custody [updated 2019]
- Computer forensics: Network forensics analysis and examination steps [updated 2019]
- Computer Forensics: Overview of Malware Forensics [Updated 2019]
- Incident Response and Computer Forensics
- Computer Forensics: Memory Forensics
- Comparison of popular computer forensics tools [updated 2019]
- Computer Forensics: Forensic Analysis and Examination Planning
- Computer forensics: Operating system forensics [updated 2019]
- Computer Forensics: Mobile Forensics [Updated 2019]
- Computer Forensics: Digital Evidence [Updated 2019]
- Computer Forensics: Mobile Device Hardware and Operating System Forensics
Get certified and advance your career
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, (ISC)², Cisco, Microsoft and more!
Digital forensics
Digital forensics
Digital forensics
Digital forensics
Snort demo: Finding SolarWinds Sunburst indicators of compromise