iOS Boot Process

The use of the mobile phone has become more common, so you can conduct your banking and money-related operations on it, which has prompted some people to hack phones to steal sensitive information. Therefore, forensic analysis is considered one of the important skills that an IT employee must have to be able to investigate the crimes committed in Palestine. There are laws to reduce, criminalize, and punish electronic crimes.

This chapter will use a real practical case study related to child pornography to introduce iOS forensics. Child pornography is regarded as a crime punishable under the law in Palestine and elsewhere in the world because it is an immoral act designated to sexually exploit children over the Internet, by which criminals send and receive photos and videos of children. This is a criminal offense.

The Palestinian Cybercrime Law, established in 2018, is based on the Jordanian Cybercrime Law, and it constitutes a line of defense and a deterrent to acts violating the law committed through the Internet using a computer, mobile phone, or any technological means, but there is a gap in the law as penalties and fines do not constitute a deterrent to criminals. In this chapter, we will present some laws related to the sexual exploitation of children and their punishment according to the Cybercrime Law in Palestine [1]. In addition to that, we will present some of the laws related to the sexual exploitation of children stipulated in the Electronic Crimes Law in Palestine, and we will also present a case study that some researchers will address related to the sexual exploitation of children via mobile phone.

Before testing the iPhone, it is necessary to identify the correct hardware model and firmware installed on the device. There are several ways in which you can identify the hardware for a device that is a tool that is a recommended libimobile device. The iPhone is a group of modules, chips, and electronics of various manufacturers. Because of the complexity of the iPhone, the list of hardware parts and internal components for each device is extensive.

iOS Architecture

In this practical case, we will start our investigation on iOS, known formally as the iPhone Operating System. Also, we have to know that the iOS is derived from Mac OS, which in turn is based on UNIX- OS. iOS was at the early stage of the development of a famous application, which is the iPod as the digital storage and application to run music. Later, the development became fast with very common applications like mail, in a browser known as Safari.

To start investigations in mobile, the investigators should have good knowledge of the architecture of the mobile systems. Figure 2-1 illustrates the architecture of the mobile, which consists of three main module layers: the presentation layer, which contains UI components; the business layer, which is composed of business entities and workflow; and the data layer, which contains data access components, data utilities, and service agents (mobile app architecture, e.g.). And it is important to differentiate between the iOS architecture and the Android architecture: although they are both operating systems that have the same architecture, they do have not the same functionality. Android works under Linux kernel, whereas iOS works under BSD-derived kernel, so both of them are Unix based.

iOS is the operating system that runs on a variety of Apple devices as illustrated in Figure 2-1, the iPhone being one of the most popular. In 2007, Apple debuted the iPhone, which revolutionized the smartphone market. It had a huge touch screen as well as remarkable technical characteristics, at least at the time. The Cocoa Touch library is used to develop iOS applications in Objective-C. Objective-C is a C language extension, whereas Cocoa Touch is a collection of classes. While the syntaxes of C# and Java (used for Android and Windows Phone development) are similar, the Objective-C library offers a unique option. Object-oriented programming is supported by Objective-C, as the name indicates. The language and platform have steadily improved over time, with the advent of ARC (Automatic Reference Counting) being a particularly notable advance. As a result of the automated memory management, the amount of boilerplate code was decreased, and memory leaks were minimized in general. A Mac machine is required for iOS development. Xcode is the most often used program for developing iOS apps. It comes with a robust editor, an analytical tool, an iOS emulator, and the SDK (Gronli, Hansen, Ghinea, & Younas, 2014).

As the operating system developed by Apple, iOS constitutes the primary platform for Apple mobile devices (Gyorödi, Zmaranda, Georgian, & Gyorödi, 2017). This system controls all services and parts of Apple devices. The iOS operating system was launched for the first time in 2007 with the launch of the first iPhone device, where the name of the operating system was OS X; the name was changed to iOS in 2010 (Aleem, 2019). The iOS operating system architecture has four layers: the core OS, core services, media, and the Cocoa Touch layer (Yates, 2010).

The iPhone is a collection of modules, chips, and electronic components from different manufacturers. Due to the complexities of the iPhone, the list of hardware components is extensive, and each device should be researched for internal components: for example, iPhone 11 has an A13 Bionic processor; storage (64 GB, 128 GB, or 256 GB); 4 GB of RAM; a 6.1-inch Liquid Retina liquid crystal display (LCD); and a dual-lens 12 MP, rear camera array. As with the iPhone, not all versions of the iPad are supported for file system acquisition; Apple changes data storage locations in iOS versions, which affects iPad devices as well, and so you must be aware of the different models, the released and currently installed iOS version, the storage capability, and the network access vectors. Internal images for all iPhones can be found in the teardown section of https://www.ifixit.com/Device/iPhone.

Just like the iPhone, the iPad is also a collection of modules, chips, and electronic components from different manufacturers. The internal images for all iPads can be found in the teardown section of https://www.ifixit.com/Device/iPad.

The iOS operating system acts as an intermediary between the applications running on the screen and the hardware components of the device. The iPhone has two partitions, the iOS system partition and the iOS data partition (Höne, Kröger, Luttenberger, & Creutzburg, 2012). The contents of the iOS system partition, which is used for the operating system and read-only for the user, may not be evidentiary, but it may be necessary to examine it (Höne et al., 2012). The iOS data partition is used as a read/write for the user and the applications so the evidence can be acquired from this partition (Höne et al., 2012). iOS performs its roles through four layers (Aleem, 2019), as shown in Figure 2-1.

iOS Architecture Layers

1.     Cocoa Touch Layer: The top layer of the iOS architecture, this layer consists of a set of basic frameworks for developing the visual interface and providing the basic infrastructure for applications on the iOS system such as touch, multitouch, input services and processes, and high-level tasks (Aleem, 2019).

2.     Media Layer: This application consists of basic multimedia frameworks such as audio, video, and graphics. This layer provides an aided environment for programmers to create applications with a distinctive graphic appearance (Aleem, 2019).

3.     Core Service Layer: This layer works to provide the basic services required for applications on the system, such as location services, communication services, and iCloud services (Rupesh, 2017).

4.     Core OS Layer: This layer is located directly above the device’s hardware, and it deals with basic, low-level functions in the device, such as memory management, file system, communication, and networking (Aleem, 2019).

The iOS system enjoys high protection, and with the development of this system, the protection from the company has increased to the point that Apple offers huge rewards every period for those who can penetrate this system and find a loophole in it. If this indicates something, it indicates the extent of Apple’s confidence in its system and the level of protection it has in it.

The HFS Plus and APFS File Systems

To accommodate the storage of large datasets, Apple has developed a new file system, HFS, as illustrated in Figure 2-2. The HFS Plus file system supports larger sizes of files, and the HFS Plus volume includes a number of internal structures for data management. The volume of HFS Plus contains a multilayer of internal structures that are used to manage the organization of data. Such structures include header, an alternate header, and five special files: the allocation file, the extents overflow file, the catalog file, the attributes file, and the startup file. Of these five files, three (extents overflow file, catalog file, and attributes file) use the B-Tree structure.

Assume that a law enforcement official legally seizes a certain number of suspicious smartphones during a criminal investigation, which could be analyzed on smartphones using child pornography. The difficulty of identifying and verifying the existence of hidden child pornography on any particular phone is increasing as a result of the ever-increasing number of smartphones and law enforcement files [1]. Some of the forensic equipment on the market is currently being researched. Although many human interventions and manual tasks are required to limit the efficiency of crime scene evidence collection, the Access Data Forensic Toolkit and Guidance Encase are primarily used for collecting information from storage devices. The most common tools for analyzing and detecting nude images are the Paraben Porn Detection Stick and the SDK (Software Analyzer) [2].

The iPhone APFS is a state-of-the-art file system for iOS, macOS, tvOS, and watchOS. It is basically a 64-bit file system that supports over 9 quintillion files on one single volume. APFS is structured in one single container that may contain one or more volumes. Every structure of the APFS file system begins with a block header. The BH starts with a checksum (used Fletcher’s checksum algorithm). The entire block also contains the version of a copy-on-write block, the block ID, and the block type.

iOS Security

Apple iOS devices, like iPhone, iPod, and iPad, have been designed with several layers of security. The low-level security layer consists of hardware features that safeguard from malicious attacks, and the high-level security layer protects OS features from unauthorized access and use. Features provided in the following image are considered the main iOS security features:

iOS provides advanced security features, many of which are enabled by default; users don’t need to perform extensive configurations. The key security features are not configurable, so users cannot disable them by mistake. The security features that will be addressed in this study are the code signing and privilege separation features, which get affected by jailbreaking an iPhone.

Code signing: the process by which a compiled iOS application is sealed and users are assured that it is from a known source and has not been tampered with since it was last signed with a certificate issued by Apple. This would prevent Apple users from downloading and installing unauthorized applications on jailed iPhone devices.

Privilege separation: “iOS runs with the principle of least privilege (PoLP). It contains two user roles: root and mobile. The most important processes in the system run with root user privileges. All other applications to which the user has direct access, such as the browser and third-party applications, run with mobile user privileges”.

iOS Data Extraction Techniques

Data Acquisition from Backup Devices

Copying the whole contents of a file system to a backup medium is the easiest technique to secure a file system against disk failures or file corruption. A full backup is a name given to the generated archive. A file system can be recreated from a full backup onto a new disk if it is lost later due to a disk failure. It is also possible to recover individual files that have been misplaced. Full backups have two drawbacks: reading and writing the complete file system takes a long time, and keeping a copy of the file system takes up a lot of storage space on the backup media.

An incremental backup strategy replicates just those files that have been created or updated since the last backup, resulting in faster and smaller backups. Because only a tiny fraction of files change on any given day, incremental backups are smaller. A common incremental backup strategy combines complete backups with regular incremental backups. In an incremental backup system, restoring a deleted file or an entire file system takes longer; recovery may entail examining a chain of backup files, starting with the most recent complete backup, and applying changes recorded in one or more incremental backups. Backup is a method of backing up a device’s contents, which includes only the files currently loaded on the device and excludes deleted files. Logical acquisition is the name of this procedure (Chervenak, 1998). Most of these products have been operating independently, and no forensic tool provides more than a technical framework for detecting child pornography. Through careful education, log analysis, file names, and cell location analysis, the proposed design model proposes a method for automatically collecting and processing image films on smartphones to detect child pornography images quickly. This will reduce the amount of human intervention and handling of materials collected and processed by law enforcement officers, as well as speed up investigations.

WhatsApp Messenger is the world’s most popular multiplatform instant messaging app, allowing users to exchange text, images, video, and audio for free. The Jamaican police, for example, use WhatsApp to prevent child exploitation via social media. Before law enforcement can determine which CSA images are stored on suspicious smartphones, the logical flow of image creation, dispatch, and deletion in WhatsApp must be understood [1]. This practical case was carried out using two iPhones as depicted in Figure 2-3.

1. (1).

   Phone A: Unjailbroken iPhone 4S (iOS 8.4.1).

    
2. (2).

   Phone B: Jailbreak iPhone 5S (iOS 9.3.3).

    

Data Acquisition from iOS Devices

The following are the steps to create a backup of iPhone 6s using iTunes. First, connect the iPhone to your computer using the cable. Second, unlock iPhone by typing the passcode to access the phone. Third, open iTunes and click on backup. There will be two options: encrypted backup and unencrypted backup. The encrypted backup will encrypt the data with a private key and password, and additional information will be retrieved such as WIFI setting. In this chapter, we have done an unencrypted backup since we are interested in images and deleted images. Fourth, after the backup is done, the file of the backup will found in the backup folder as shown in Figure 2-4.

Jailbreaking

Jailbreaking simply means removing limitations imposed by Apple’s mobile OS through the use of software and hardware exploits; this will permit unsigned code to run and gain root access on the OS. The most common reason for jailbreaking is to expand the limited feature set imposed by Apple’s App Store and to install unapproved apps.

iOS Forensic Tools

iOS Data Analysis and Recovery Using Belkasoft Tool

Now we are ready to use one of the most common mobile forensics tools called Belkasoft; it has SQLite integrated with this tool so we need to install SQLite separately. First, we create a case as shown in Figure 2-5.

Second, we select the folder that was created by iTunes (backup folder in Figure 2-3) as shown in Figure 2-6.

Third, we select a set of artifacts to investigate as shown in Figure 2-7.

Fourth, after analyzing the artifacts on Belkasoft for "Child-pn", which is a child pornographic image, the result we get using this tool indicated that the image was not found.

iOS Data Analysis and Recovery Using Axiom Tool

The second tool is Magnet Axiom ; it’s a common tool used for mobile forensics. First, create a case using Magnet Axiom: the case number is 2021116, as shown in Figure 2-8.

Second, choose artifact (what is important in our case study is images) as shown in Figure 2-9.

Third, after analyzing all artifacts, we checked the images, and fortunately we found the evidence, which is a child pornographic image as shown in Figure 2-10.

Fifth, it’s important to present the hash value of the evidence for the purpose of integrity, as shown in Figure 2-11.

Mobile Forensics Investigation Challenges on iOS Devices

Summary

With the first-generation iPhone in June 2007, iPhone forensics became more challenging when it comes to dealing with file system forensic acquisition methods, as there is no method or tool available to physically recover data from these devices unless they are jailbroken, while the logical acquisition can be obtained if the iPhone is unlocked.

Axiom and Belkasoft are two of the best and most powerful programs in the process of forensic analysis of mobile phones; they both support mobile phones and computers, and this is a good thing. The Belkasoft can retrieve about 700 artifacts. It is easy to use, and it has an easy-to-use scripting module you can write your scripts with, but it is not free and the price may be high. As for Axiom, it can recover about 500 different artifacts and is also not free, but a trial version is available. Axiom is a consumer of computer resources, and it is generally slow and does not respond quickly. In this case, we chose the Belkasoft program for speed because we are at the airport, and we only have two hours. We want a fairly fast program. What is important in our case study is that Belkasoft failed in retrieving deleted images that were downloaded using WhatsApp, in contrast to Magnet Axiom, which successfully retrieved the child pornographic images. Magnet Axiom used a carving method to retrieve the images; this method also exists in Belkasoft but can’t be applied for some reason.

In the end, the Axiom program showed its superiority over Belkasoft, although it was somewhat slow. It succeeded in recovering the deleted image, and it was able to recover the deleted image on the iOS system without jailbreaking.

Practical Lab 2.1

Connect the iPhone to your workstation using a universal serial bus (USB) cable (for the latest iOS versions, the passcode is also required), and run the ideviceinfo command with the -s option ( $ ideviceinfo -s ), as shown in Figure 2-12.

References