Of course, commercial tools are more stable and reliable. One of the tools that's capable of filesystem acquisition is the Elcomsoft iOS Forensic Toolkit. Here, we are going to acquire a jailbroken iOS device running iOS 12.4.3.
The steps to do this are as follows:
- Connect the device to your workstation and start Toolkit.cmd.
- Choose the port to use for SSH connection (the default is 22, but since we used checkra1n for jailbreaking, the port is 44 instead) and type in the password (the default is alpine):
- To acquire the device filesystem, type F:
- Choose the image name and start the process.
Once the process has finished, we'll have a filesystem image ready to be analyzed with a mobile forensic tool of our choice.