iTunes - Forensic guys' best friend
What chances do you think to acquire suspect's data from his/her iDevice? If suspects also use iTunes or iCloud, I will say it's in the bag.
What's inside a seized iPhone? Suspect refused to tell us and he was very confident that no one could unlock his iPhone.
Fortuneately we got suspect's Laptop and found our best friend "iTunes". Why iTunes is our best friend? Because when you connect your iDevice to the PC/Mac/laptop with iTunes installed, iTunes will sync and backup data from iDevice. The "secret" is the plist in the lockdown folder. If you got this plist of suspect's iDevice, you could take advantage of it to establish "Trust" relationship between your forensic workstation and suspect's iDevice. Of course a plist file corresponds to certain iDevice.
Copy those plist files to the lockdown folder on forensic workstation, and connect suspect's iPhone to the forensic workstation. The Magic works~ You don't have to press any buttion on that iPhone. The "Trust" relationship is already there. Now we could use iTunes to backup data from suspect's iPhone, and we don't need to unlock supsect's iphone. After backup completed, you could got everything in suspect's iPhone now.
Congraulations!!! Even you don't have any forensic tools, you could use iTunes to restore that backup file to another iPhone. So you will know whether there is any clue or not.
Never doubt that~ Even you use commercial mobile forensic tool, the secret is still the plist file.
最新文章
- ServiceController1
- android 实现拍照的2种方法
- 嵌入式X86运行linux及QtEmbedded+触摸屏(X86PC104+Xlinux+QtE+触摸屏解决办法)
- Anaconda packages list
- iOS监听电话事件
- Mysql优化之创建高性能索引(二)
- HDU 2516 取石子游戏 （博弈论）
- git简单使用教程
- Qt 5.5 tr usage
- TASKCTL产品功能清单-转载
- django作业2
- this对象指向
- 关于Intent
- requireJS简单应用
- 14. Redis配置统计字典
- 跳转语句之continue
- djaogo 图片上传与读取
- HTML5之美
- 基于jQuery仿迅雷影音官网幻灯片特效
- ORACLE数据导入导出后新数据库中某些表添加操作报错[ORA-12899]