ios_foensics

It is useless to state that iPhones, iPads, and iPods which we use every single second in our life are developed by Apple company and operate on an operating system named iOS. They are hence referred to as iOS devices.

  • What about iPhones?

The absolutely most commonly used iOS devices are iPhones. This aspect is actually attributed to the fact that the appearance, the camera, and features offered by iPhones are really the best in the market. Several iPhone models were released by Apple. The following table is intended to discuss more of the latest iPhone releases along with their specifications. The progress of iPhone devices throughout the years could be for sure noticed significantly when looking at the coming table. The following table displays the most important features of iPhone 6, iPhone 6s, iPhone SE, and iPhone 7 are the iPhone models which are currently on the market and very popular due to their great features and performance.

Model of iPhoneSpecs of CameraCellular radioSpecs of CPUFirmware (Operating System version)RAMStorage
iPhone 5Front Camera: 1.2MP

Rear Camera:

8.0 MP

Up to LTE(4G)Speed of CPU: 1.2 GHz
Instruction Set is ARMv7s
IOS 6.01GB16/32/64 GB
iPhone 5sFront Camera: 1.2MP

Rear Camera:

8.0 MP

Up to LTE(4G)Speed of CPU: 1.3 GHz
Instruction Set is ARMv8
IOS 7.01GB16/32/64 GB
iPhone 6Front Camera: 1.2MP

Rear Camera:

8.0 MP

Up to LTE(4G)Speed of CPU: 1.38 GHz
Instruction Set is ARMv8
IOS 7.01GB16/32/64 GB
iPhone 6sFront Camera: 5MP

Rear Camera:

12.2 MP

Up to LTE(4G)Speed of CPU: 1.85 GHz
Instruction Set is ARMv8
IOS 9.02 GB16/32/64 GB
iPhone SEFront Camera: 1.2MP

Rear Camera:

12.2 MP

Up to LTE(4G)Speed of CPU: 1.85 GHz
Instruction Set is ARMv8
IOS 9.32 GB16/32/64/128 GB
iPhone 7Front Camera: 7MP

Rear Camera:

12.2MP

Up to LTE(4G)Speed of CPU: 2.34 GHz
Instruction Set is ARMv8
IOS 102 GB32/64/128 GB

 

  • What about iPads?



iPad Tablets were launched right after the success witnessed by iPhones in the market. The name of iPad or iPad first Generation was initially granted to the very first iPad tables released in the market. The time of its launch was actually right after launching iPhone 3Gs when iPhone 4 was not released so far. The specifications of the different releases of iPad Tablets and models are stated clearly and displayed throughout the following table.

Model of iPadSpecs of CameraCellular RadioSpecs of CPUFirmwareRAMStorage
iPad AirRear Camera: 5 MpUP to LTE (4G)Speed of CPU: 1.4 GHz
Instruction Set is ARMv8
IOS 7.0.31 GB16/32/64/128 GB
iPad Air2Rear Camera: 8 MpUP to LTE (4G)Speed of CPU: 1.5 GHz
Instruction Set is ARMv8
IOS 8.12 GB16/64/128 GB
iPad ProRear Camera: 8 MpUP to LTE (4G)Speed of CPU: 2.2 GHz
Instruction Set is ARMv8-A
IOS 9.14 GB32/128/256 GB
iPad (5th Gen)Rear Camera: 8 MpUP to LTE (4G)Speed of CPU: 1.85 GHz
Instruction Set is ARMv8
IOS 10.32 GB32/128 GB
iPad Pro (2nd Gen)Rear Camera: 12 MpUP to LTE (4G)Speed of CPU: 2.38 GHz
Instruction Set is ARMv8
IOS 10.3.24 GB64/256/512 GB
iPad mini 4Rear Camera: 8 MpUP to LTE (4G)Speed of CPU: 1.49 GHZIOS 9.02 GB16/64/128 GB

 

  • What about iPods?



iPods were initially intended to be designed for the sake of providing their users with capabilities of playing music. This was back in 2001 when the “First Generation” iPods were developed. Then, with time and with developing the “Second Generation” and the “Third Generation” and all of these products, users were given the advantage of playing Videos and Games.

Data from an iPod is also of importance to an examiner performing the forensic investigations. Through iPods, forensics data from Storage, Gallery, or the browser could be of interest to the investigation process when such data gets retrieved.

The following features are actually offered by iPod devices: Camera, Wi-Fi Capabilities, Safari web browser, Storage and Playback for Audio, Video, and Photo, YouTube player, Apps could be installed from App store.

  • Where can I find the passwords of iOS devices?



If we are interested in finding the password which was configured by the user, we can find it inside the following file directory:  /private/etc/passwd

Such directory resides inside the system partition of an iOS device, which is mainly used for maintain information of the operating system and the necessary files to open it and maintain it as well.

The password of the root and the entire mobile device will be displayed as something like: smx7MYTQIi2M

Such hash could be simply retrieved back and be used as a valuable information for an examiner through such password file.

Aslo, using a password cracking utility such as John the Ripper could be helpful when it comes to crack the password.

The default password utilized for the root of an iOS device is basically “Alpine” and all iOS devices share this common feature.

  • Property List Files:

The importance of such files lies in the fact that data such as web cookies, email accounts, GPS Map routes and searches system configuration preferences, browsing history and bookmarks can all be found inside there. They are actually of a format of XML. Configurations of the applications on an iOS device and the configuration of the operating system itself are directed by these files. A text editor could simply be depended on in order to get such files opened and reviewed.

  • SQLite Databases:

When extracting data from an iOS device, a great deal of the data will be coming in the form of a SQLite database. This drives the need for having a browser to get them open. Such browser could be downloaded from the following link: http://sqlitebrowser.org/

References

https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092

http://resources.infosecinstitute.com/ios-forensics/

https://www.cclgroupltd.com/mobile-device-forensics-data-acquisition-types/

LEAVE A REPLY

Please enter your comment!
Please enter your name here