iOS Forensics Advanced Logical File System Extraction and CHECKM8 for iPhones
Part 1 of Cellebrite Solutions 2023 Update Summary
Cellebrite released many updates to its digital intelligence and forensics solutions in 2022. These updates were covered in a recent on-demand webinar you can watch here.
The webinar is split into 4 main solution updates sections:
- Mobile Forensics for iOS and Android Devices
- Computer Forensics for Windows and Mac Platforms
- Frequently Asked Questions
- Live – Questions-and-Answers
This blog will highlight the mobile device forensic tool updates supporting iOS devices.
Advanced logical file system extraction
The advanced logical file system extraction is equivalent to the iTunes backup. This method of data extraction is available for all iOS devices, regardless of the version of the iOS installed, and regardless of the hardware platform.
The recent iOS releases versions 15 and 16 are also supported in the advanced logical file system extraction. To perform extractions on devices with the latest iOS version, always keep your UFED software version up-to-date.
Watch the video below – How to Use Cellebrite UFED or Physical Analyzer to Perform iOS Advanced Logical Extractions
CHECKM8
Next are updates to CHECKM8 which is a full file system extraction solution that supports A7 to A11 devices on the condition that the device does not have a passcode, or the passcode is known to you. So generally, this data in an extraction covers the support for iPhone 5S to iPhone X.
CHECKM8 support for 15.7 is included in the latest UFED 7.60. Support for the IOS 16 is under development and we hope to bring you this in a future release. Regarding iPhone 8, 8+ and iPhone X running iOS 14 to 15.7, the extraction flow is different from the usual one. The user passcode has to be removed from the device before attempting the CHECKM8 extraction.
Watch the video below – How to Perform a BFU Extraction Using checkm8 in Cellebrite UFED
Animated iOS DFU
Now on to Animated iOS DFU (Device Firmware Upgrade) mode instructions. This feature is included in UFED 7.56. To perform the CHECKM8 full file system extraction, the iOS device has to be placed in recovery mode and enter DFU mode from the recovery. So, placing the device in DFU mode can be tricky, especially if you have not attempted it before. And the challenging areas are different for the various iOS devices that have different instructions to enter DFU mode.
There is no on-screen indication that the device has entered DFU mode successfully, and you will have to perform each step carefully taking note of the timings. If any steps are missed in the process, the device may restart instead of entering the DFU mode. The whole process has to be repeated till the device shows a black screen, which will then indicate that the device has successfully entered DFU mode.
UFED makes the whole process less agonizing by providing animated instructions. An interactive image gives detailed instructions and a timer to carry out each step more accurately. If there’s anything missing in the process, hit the restart button to start the process from the beginning.
Stay tuned for Android Forensics – Part 2 of the Cellebrite Solutions 2022 Update Summary
Keep reading to discover the top 10 reasons why iOS forensics is essential for digital investigations.
In the realm of digital investigations, iOS forensics plays a vital role in uncovering evidence and providing valuable insights into Apple devices, particularly iPhones. With its extensive capabilities, iOS forensics has become an indispensable tool for digital forensics experts worldwide. In this article, we will explore the top 10 reasons why iOS forensics is crucial for digital investigations. Additionally, we will address the top 10 questions commonly asked about iOS forensics. So let’s dive in and discover the significance of iOS forensics in the world of digital investigations.
1. Comprehensive Data Extraction
iOS forensics enables digital investigators to perform thorough data extraction from iPhones and other Apple devices. This process involves retrieving various types of data, including text messages, call logs, contacts, photos, videos, and more. The ability to extract a wide range of data significantly aids in building a comprehensive case.
2. Unlocking Encrypted Information
Apple devices are known for their robust security features, including data encryption. However, iOS forensics tools and techniques provide the means to bypass these encryption barriers. Forensic experts can unlock encrypted information, revealing critical evidence that would have otherwise remained hidden.
3. Analysis of Third-Party Applications
Third-party applications are ubiquitous in today’s digital landscape. iOS forensics empowers investigators to analyze these applications thoroughly, extracting valuable data and uncovering insights crucial to digital investigations. This capability is especially significant considering the extensive use of third-party apps for communication and data sharing.
4. Tracing Digital Footprints
In the digital realm, individuals leave behind digital footprints that can be valuable in investigations. iOS forensics allows experts to trace these footprints, uncovering information such as browsing history, app usage, social media activity, and more. This valuable data can provide important leads and context in a digital investigation.
5. Recovery of Deleted Data
In many cases, perpetrators attempt to cover their tracks by deleting data from their devices. However, iOS forensics has the ability to recover deleted data, including messages, photos, documents, and other files. This recovery process can shed light on crucial pieces of evidence that may have seemed lost forever.
6. Examination of Internet Activities
Understanding an individual’s online activities is often essential in digital investigations. iOS forensics enables investigators to examine internet activities, including browsing history, search queries, and downloads. This information can help establish connections, timelines, and motives related to a case.
7. Unearthing Communication Evidence
iOS forensics tools are highly effective in extracting communication evidence from iPhones. Investigators can retrieve text messages, call logs, emails, and instant messaging conversations. These pieces of evidence can provide valuable insights into the interactions and communications of individuals involved in a case.
8. Investigation of Location-Based Data
Location-based data can be invaluable in digital investigations, helping establish an individual’s whereabouts during specific times. iOS forensics allows experts to access GPS data, Wi-Fi connections, and geolocation information stored on Apple devices. This data can serve as crucial evidence in corroborating or disproving alibis.
9. Enhancing Forensic Reporting
Effective forensic reporting is vital for presenting evidence and findings in a clear and concise manner. iOS forensics tools provide features that assist in generating comprehensive reports, including data visualization, timeline analysis, and summary of findings. These reports enhance the communication of complex information to stakeholders involved in a case.
10. Staying Updated with Apple’s Ecosystem
The ever-evolving nature of Apple’s ecosystem necessitates continuous adaptation by digital forensics experts. Staying up to date with the latest iOS updates, security features, and changes in device architecture is crucial to ensure effective and accurate forensic analysis. iOS forensics specialists are well-versed in navigating this dynamic environment.
Conclusion
The significance of iOS forensics in digital investigations cannot be overstated. Its ability to perform comprehensive data extraction, unlock encrypted information, and analyze third-party applications makes it an essential tool for digital forensics experts. By tracing digital footprints, recovering deleted data, and investigating internet activities, iOS forensics unveils critical evidence and provides valuable insights. As technology evolves, staying updated with Apple’s ecosystem is essential to ensure effective forensic analysis. With iOS forensics, digital investigators can navigate the intricacies of Apple devices and unravel the truth hidden within the digital realm.
