Important Background of iOS devices before forensics

It is useless to state that iPhones, iPads, and iPods which we use every single second in our life are developed by Apple company and operate on an operating system named iOS. They are hence referred to as iOS devices.

  • What about iPhones? ios devices

The most commonly used iOS devices are iPhones. This aspect is attributed to the fact that the appearance, the camera, and features offered by iPhones are the best in the market. Several iPhone models were released by Apple. The following table is intended to discuss more of the latest iPhone releases along with their specifications. The progress of iPhone devices throughout the years could be for sure noticed significantly when looking at the next table. The following table displays the most important features of iPhone 6, iPhone 6s, iPhone SE, and iPhone 7 are the iPhone models which are currently on the market and very popular due to their excellent features and performance.

Model of iPhone Specs of Camera Cellular radio Specs of CPU Firmware (Operating System version) RAM Storage
iPhone 5 Front Camera: 1.2MP

Rear Camera:

8.0 MP

Up to LTE(4G) Speed of CPU: 1.2 GHz
Instruction Set is ARMv7s
IOS 6.0 1GB 16/32/64 GB
iPhone 5s Front Camera: 1.2MP

Rear Camera:

8.0 MP

Up to LTE(4G) Speed of CPU: 1.3 GHz
Instruction Set is ARMv8
IOS 7.0 1GB 16/32/64 GB
iPhone 6 Front Camera: 1.2MP

Rear Camera:

8.0 MP

Up to LTE(4G) Speed of CPU: 1.38 GHz
Instruction Set is ARMv8
IOS 7.0 1GB 16/32/64 GB
iPhone 6s Front Camera: 5MP

Rear Camera:

12.2 MP

Up to LTE(4G) Speed of CPU: 1.85 GHz
Instruction Set is ARMv8
IOS 9.0 2 GB 16/32/64 GB
iPhone SE Front Camera: 1.2MP

Rear Camera:

12.2 MP

Up to LTE(4G) Speed of CPU: 1.85 GHz
Instruction Set is ARMv8
IOS 9.3 2 GB 16/32/64/128 GB
iPhone 7 Front Camera: 7MP

Rear Camera:

12.2MP

Up to LTE(4G) Speed of CPU: 2.34 GHz
Instruction Set is ARMv8
IOS 10 2 GB 32/64/128 GB

 

  • What about iPads?


    ios devices

iPad Tablets were launched right after the success witnessed by iPhones in the market. The name of iPad or iPad first Generation was initially granted to the very first iPad tables released in the market. The time of its launch was right after launching iPhone 3Gs when iPhone 4 was not released so far. The specifications of the different releases of iPad Tablets and models are stated clearly and displayed throughout the following table.

Model of iPad Specs of Camera Cellular Radio Specs of CPU Firmware RAM Storage
iPad Air Rear Camera: 5 Mp UP to LTE (4G) Speed of CPU: 1.4 GHz
Instruction Set is ARMv8
IOS 7.0.3 1 GB 16/32/64/128 GB
iPad Air2 Rear Camera: 8 Mp UP to LTE (4G) Speed of CPU: 1.5 GHz
Instruction Set is ARMv8
IOS 8.1 2 GB 16/64/128 GB
iPad Pro Rear Camera: 8 Mp UP to LTE (4G) Speed of CPU: 2.2 GHz
Instruction Set is ARMv8-A
IOS 9.1 4 GB 32/128/256 GB
iPad (5th Gen) Rear Camera: 8 Mp UP to LTE (4G) Speed of CPU: 1.85 GHz
Instruction Set is ARMv8
IOS 10.3 2 GB 32/128 GB
iPad Pro (2nd Gen) Rear Camera: 12 Mp UP to LTE (4G) Speed of CPU: 2.38 GHz
Instruction Set is ARMv8
IOS 10.3.2 4 GB 64/256/512 GB
iPad mini 4 Rear Camera: 8 Mp UP to LTE (4G) Speed of CPU: 1.49 GHZ IOS 9.0 2 GB 16/64/128 GB

 

  • What about iPods?


    ios devices

iPods were initially intended to be designed for the sake of providing their users with capabilities of playing music. It was back in 2001 when the “First Generation” iPods were developed. Then, with time and with developing the “Second Generation” and the “Third Generation” and all of these products, users were given the advantage of playing Videos and Games.

Data from an iPod is also of importance to an examiner performing the forensic investigations. Through iPods, forensics data from Storage, Gallery, or the browser could be of interest to the investigation process when such data gets retrieved.

The following features are actually offered by iPod devices: Camera, Wi-Fi Capabilities, Safari web browser, Storage and Playback for Audio, Video, and Photo, YouTube player, Apps could be installed from App store.

  • Where can I find the passwords of iOS devices?


    ios devices

If we are interested in finding the password which was configured by the user, we can see it inside the following file directory:  /private/etc/passwd

Such directory resides inside the system partition of an iOS device, which is mainly used for maintain information of the operating system and the necessary files to open it and maintain it as well.

The password of the root and the entire mobile device will be displayed as something like smx7MYTQIi2M

Such hash could be retrieved merely back and be used as valuable information for an examiner through such password file.

Also, using a password cracking utility such as John the Ripper could be helpful when it comes to crack the password.

The default password utilized for the root of an iOS device is “Alpine,” and all iOS devices share this standard feature.

  • Property List Files:

The importance of such files lies in the fact that data such as web cookies, email accounts, GPS Map routes and searches system configuration preferences, browsing history and bookmarks can all be found inside there. They are actually of a format of XML. Configurations of the applications on an iOS device and the configuration of the operating system itself are directed by these files. A text editor could merely be depended on to get such files opened and reviewed.

  • SQLite Databases:

When extracting data from an iOS device, a great deal of the data will be coming in the form of an SQLite database. This drives the need for having a browser to get them open. Such browser could be downloaded from the following link: http://sqlitebrowser.org/

References

https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092

http://resources.infosecinstitute.com/ios-forensics/

https://www.cclgroupltd.com/mobile-device-forensics-data-acquisition-types/

This post was written by hsamanoudy

Leave a Reply

Your email address will not be published. Required fields are marked *