Secure Enclave has brought new challenges to iOS forensic examiners. We can't extract the encryption keys that are required to decrypt the device image, so performing physical acquisition is useless. But there is filesystem acquisition. Unfortunately, in most cases, it requires the iOS device to be jailbroken. The next section will show you how to jailbreak an iPhone running iOS 11.4.1 with Electra and an iPhone running iOS 13.2 with Checkra1n.
Filesystem acquisition
by Rohit Tamma,
Oleg Skulkin,
Heather Mahalik,
Practical Mobile Forensics - Fourth Edition
- Title Page
- Copyright and Credits
- About Packt
- Contributors
- Preface
- Introduction to Mobile Forensics
- The need for mobile forensics
- Understanding mobile forensics
- Challenges in mobile forensics
- The mobile phone evidence extraction process
- Practical mobile forensic approaches
- Potential evidence stored on mobile phones
- Examination and analysis
- Rules of evidence
- Good forensic practices
- Summary
- Section 1: iOS Forensics
- Understanding the Internals of iOS Devices
- Data Acquisition from iOS Devices
- Data Acquisition from iOS Backups
- iOS Data Analysis and Recovery
- iOS Forensic Tools
- Section 2: Android Forensics
- Understanding Android
- Android Forensic Setup and Pre-Data Extraction Techniques
- Setting up a forensic environment for Android
- Connecting an Android device to a workstation
- Screen lock bypassing techniques
- Using ADB to bypass the screen lock
- Deleting the gesture.key file
- Updating the settings.db file
- Checking for the modified recovery mode and ADB connection
- Flashing a new recovery partition
- Using automated tools
- Using Android Device Manager
- Bypass using Find My Mobile (for Samsung phones only)
- Smudge attack
- Using the forgot password/forgot pattern option
- Bypassing third-party lock screens by booting into safe mode
- Secure USB debugging bypass using ADB keys
- Secure USB debugging bypass in Android 4.4.2
- Crashing the lock screen UI in Android 5.x
- Other techniques
- Gaining root access
- Summary
- Android Data Extraction Techniques
- Android Data Analysis and Recovery
- Android App Analysis, Malware, and Reverse Engineering
- Section 3: Windows Forensics and Third-Party Apps
- Windows Phone Forensics
- Parsing Third-Party Application Files
- Other Books You May Enjoy
Filesystem acquisition
-
No Comment
..................Content has been hidden....................
You can't read the all page of ebook, please click here login for view all page.