Chapter 6. Forensics Recovery

Forensics recovery is important, as in a few investigation cases there is a need to decrypt information from iOS devices. These devices are in an encrypted form usually. In this chapter, we will focus on various tools and scripts that can be used to read data from the devices under investigation. We are going to cover the following topics:

• DFU and Recovery modes

• Extracting and reading data

• Recovering backups

• Extracting data from iTunes backups

• Encrypting and decrypting tools

DFU and Recovery modes

In this section we'll cover both the DFU mode and the Recovery mode separately.

DFU mode

In this section, we will see how to launch the DFU mode, but before that we will explore what DFU means. DFU stands for Device Firmware Upgrade, which means this mode is used specifically with iOS upgrades. This is a mode where a device can be connected with iTunes and still do not load the iBoot boot loader. Your device screen will be completely black in DFU mode because neither the boot loader nor the operating system is loaded. DFU bypasses the iBoot so that you can downgrade your device.

How to do it...

We need to follow these steps in order to launch a device in DFU mode:

1. Turn off your device.

   

2. Connect your device to the computer.

3. Press your Home button and the Power button, together, for 10 seconds.

4. Now, release the Power button and keep holding the Home button till your computer detects the device that is connected.

   

5. After some time, iTunes should detect your device.

6. Make sure that...

Extracting and reading data

It is very important to understand the basics of the file system before you learn about the ways of extracting and reading data from the iOS device disk. All Apple operating systems use the same file system, hierarchical file system (HFS).

This file system works with the 512 byte-formatted block scheme. To categorize it further, these blocks are divided into two parts: allocation blocks and logical blocks. Logical blocks are available on the volume numbered from the first to the last block. These blocks remain static on the disk. Allocated blocks work with a different strategy; they can be grouped together to utilize the HFS more efficiently. The file structure includes the Allocation and Attributes Files, along with the Volume Header and Catalog Files, and so on.

Getting ready

To understand the extraction well, we will study a little about some of the headers of the HFS file system in detail.

The HFS+ Volume Header

For the HFS format disk, the boot blocks are sectors...

Recovering backups

The backup format for Apple devices is a bit different from other devices. To back up our Apple device we need to have iTunes installed on our computer and we can also take a backup on iCloud. This backup analytics is available from iOS 5 onwards.

How to do it...

Let's discuss how to take a backup on iTunes, and on iCloud as well.

iCloud backup:

iCloud is a kind of virtual data storage on the Internet. To store anything on iCloud, the user needs to register with an Apple account. On iCloud, the user can keep a backup of their photos, application data, contacts, messages, e-mail, and so on. To use the iCloud storage, the user needs to connect with the Internet. iCloud services don't depend on computers to store their data. It is a kind of computer-free backup solution. iCloud data can be managed and accessed by any of the Apple devices—iPhone, iPad, iPod, and computers as well. The user just needs to login with his Apple account credentials. iCloud allows a user to store...

Extracting data from iTunes backups

Extracting the logical information from the iTunes backup is crucial for forensics investigation. There is a full stack of tools available for extracting data from the iTunes backup. They come in a wide variety, from open source to paid tools. Some of these forensic tools are Oxygen Forensics Suite, Access Data MPE+, EnCase, iBackup Bot, DiskAid, and so on. The famous open source tools are iPhone Backup Analyzer and iPhone Analyzer. In this section, we are going to learn how to use the iPhone backup extractor tools.

How to do it...

The iPhone backup extractor is an open source forensic tool that can extract information from device backups. However, there is one constraint that the backup should be created from iTunes 10 onwards. Follow these steps to extract data from iTunes backup:

1. Download the iPhone backup extractor from http://supercrazyawesome.com/.

2. Make sure that all your iTunes backup is located at this directory: ~/Library/ApplicationSupports/MobileSync...

Encrypting and decrypting tools

Another backup format came into the picture using the Manifest file with the extension .abdb. To retrieve these backups, find the file in the backup folder.

The Manifests uses a proper binary format. Nowadays, in open source, plenty of scripts are available to parse the data.

How to do it...

1. A sample for the Python script to read the Manifest is as follows:

   #!/usr/bin/env python
   import sys
   import shutil
   import os
   import errno
   
   def mkdir_p(path):
   try:
   os.makedirs(path)
   except OSError as exc: # Python >2.5
   if exc.errno == errno.EEXIST:
   pass
   else: raise
   
   def getint(data, offset, intsize):
   """Retrieve an int (big-endian) and new offset from the current offset"""
   value = 0
   while intsize > 0:
   value = (value<<8) + ord(data[offset])
   offset = offset + 1
   intsize = intsize - 1
   return value, offset
   
   def getstring(data, offset):
   """Retrieve a string and new offset from the current offset into the data"""
   if data[offset] == chr(0xFF) and data[offset+1] == chr(0xFF...