Good afternoon Alice 🎀🔮

I'm preparing a pretty big post about phone tracking so far, but to keep you entertained I decided to make a short post and a collection of articles about iOS forensic.🍏

For starters, the preparation phase.

It plays a big role for forensics for example: determining the possible location, type of media, format of digital evidence and its cryptographic key.

In mobile devices, sources and types of digital evidence include : video files, browsing history, GPS, locations, apps .

Therefore, it is imperative that during the preparation phase, forensic scientists to get the product information and record everything.
Sometimes in iOS forensics, you need to understand the electronic components of iOS and how they work. For example, the device's iOS camera captures a scene through a charge-coupled device and converts that to an electrical signal. The signal is then converted to digital, using an analog-to-digital converter . The image data is then formatted in a file container with an encrypted 256-bit key for each file. This is then wrapped with a data protection class key and stored in the image file metadata , then it is encrypted with an EMF key which is generated from a unique hardware UID . The encrypted image file is stored on the flash drive.
Thus, from our point of view will need to look for additional data to ensure that we have the necessary tools to recover the evidentiary other .

Another thing to understand iOS crimenalistics is to have an idea about security modules . There are several security models in iOS , such as: iOS secure download chain , iOS app signing , iOS app sandbox.

The iOS download chain uses the mechanism of secure download chain. We know many malwares and so on that infect at download level. A secure iOS download chain ensures that no low-level software is compromised and that iOS is running on a valid iDevice. Signing your app allows iOS to identify who signed it and confirm that it has not been modified since you signed it. The sandbox enhances the security and integrity of the operating system by limiting the capabilities of the app.

Next, after preparation, comes the investigation of here is a useful directory for it.

clipboard

/private/var/mobile/Library/caches/com.apple.UIKit.pboard

Keyboard

/private/var/mobile/library/keyboard

Locations

/private/var/root/Library/Caches/locations/consolidated.db
/private/var/root/Library/Caches/locations/cache_encryptedA.db

Screenshots

/private/var/mobile/Library/Cache/Snapshots/
/private/var/mobile/Applications/<app_UUID>/Library/Caches/Snapshots

Spotlight

/private/var/mobile/Library/Spotlight

Wallpaper

/private/var/mobile/library/trampboard/

More logs and stuff

/private/var/log/lastlog
/private/var/mobile/Library/Preferences/com.apple.voicemail.plist
/private/var/preferences/csidata 
/private/var/run/configd.pid 
/private/var/run/resolv.conf 
/private/var/root/Library/Lockdown/data_ark.plist
/private/var/tmp/MediaCache/diskcacherepository.plist 
/private/var/log/wtmp 
/private/var/mobile/Library/Voicemail/_subscribed 
/private/var/mobile/Library/Voicemail/voicemail.db 
/private/var/preferences/SystemConfiguration/.
NetworkInterface.plist 
com.apple.AutoWake.plist 
com.apple.network.identification.plist 
com.apple.wifi.plist 
preferences.plist

Different tools are often used for iso investigations, here are some good ones MOBILedit, Athena , Lantern, SIMIS , Neutrino , XACT, Final , Elcomsoft, OXYGEN Forensics, iExplorer.
That's all🔆 , it got pretty blurry, but for more details see the archive below .
Thanks for reading❤️🧩
Remember the deeper the rabbit hole the further you can go🐰

#ios #forensics #mobile