iPhone Forensics & Data Recovery - Get Deleted Text Messages

http://harddrivefailed.blogspot.com/

---

Closed Caption:

ok so today we're going to be doing a
iphone forensic demonstration and you
know this is a demonstration so we want
to focus on that as much as possible so
we're not going to spend a lot of time
talking about it but I feel we do need
to cover just a little bit of background
here
so how did it all start with the iphone
and forensics well first if you can
remember there was the ipod you know it
was cool then you have the ipod color
and it was cooler and then we had the
ipod video which is even cooler than
that and before you know it along comes
the iphone everybody had to have one and
this includes criminals so you know now
we all work to iphone 4 and you know
iPads are kinda like the hot thing to to
have right now and with that being said
you know more crimes are being committed
using mobile devices because these
devices are becoming smarter and more
capable and nothing fits this bill as
much as the iphone does now on another
video I'm gonna do some similar
forensics analysis that is we're going
to do here except i'm going to be using
an iPad to do it but today we're going
to look at how to do some basic
acquisition you know how to get the
iphone how to grab the data and then how
to analyze it in this particular video
not words that they distort well
obviously it's stored on the phone but
more specifically I'd even met flash
memory or on the onboard hard drive now
forget anytime we talk about forensics
these days since data is so mobile and
we're so mobile you have to consider
other alternative locations such as
routers firewalls are log files and
things like that as well so a lot of
times and at least in some of my bigger
cases you know the the pieces that come
with that or the smaller pieces of a
case that I the big piece together
specifically we're talking about digital
stuff soften the form of log files or
something
so I'm don't overlook those so basically
the steps are you know you need to get
the device do your best not to let the
battery died before you know plugging it
into some type of power source
i'm plugging into a musical sound
workstation of course this is all after
you've done the chain of custody
follow that properly you know use a
Faraday our bag and all these things
we're leaving out that stuff in this
particular video because this isn't to
be a more technical video and how to but
I'm we do cover this from the very
beginning the very end in some of our
forensics classes where we take you
through starting at a custody take you
through completing the chain of custody
handing off the evidence of someone else
and then you know picking up from that
point being the investigator the first
responders it actually takes the image
and we take you all the way through that
process until we get to finally uh you
know actually analyzing the data so once
we get it once we get power to it we
want to plug in our workstation a
forensics workstation load your forensic
software doesn't really matter what it
is it's whatever you're comfortable with
in this video we're going to be using
Karen acquired a dated and then analyzed
reporting you're done so that's
essentially what the the bases are so
are you know let's not waste much any
more time on the slides here we just
wanted to talk about it we're going to
be doing this against the 3gs we're
going to be using parabens device easier
to do it and we're going to focus on
acquisition and analysis in other words
get the data off the phone and then
analyzed it that's our focus today later
we can look at reporting how to use
paraben to generate pretty reports and
things like that that part i think most
people can figure out if you just hit
the report button until it what can you
want but we're going to look at some of
the more uh you know important things
when it comes to gathering this data so
let's move on to do the actual grab
alright so let's go ahead and take a
look
so we're going to start device seizure
up this is again this is comparable and
there are several things that I like
about the way paraben stuff with their
mobile forensics solution and i'm going
to share some of those would be once we
get into it here now we're just going to
create a case was named it iphone iphone
case and once we've created a case
you'll see that it will populate and
start our information dialog here and
this is where we start putting in our
case number and filling out the
different information related to this
particular case i'm just gonna you know
put some arbitrary information in here
and keep in mind we've already got the
iphone plug then it's already connected
to the computer here and you know I just
auto-populated some more information in
this little form just so we can get past
that I don't think you need my
instruction on how to enter your name
address and telephone number so let's
put a good-sounding email address here
yeah I funds.com sounds good yeah
alright so you know we got our case
populated now we need to go to data
acquisition here and this is where
actually going to adopt the data from
the iphone now for all intents and
purposes we're going to pick iphone and
ipad here and you'll understand why
won't go back later and we're just going
to select the font options us be the
only option we got here now we're going
to go ahead and select this option to
pull back up
but if you looked at the bottom notice
it's acquired structure and contents of
files that's Otto selected so we can't
really unselect that right now and
that's good because we want to select
all that stuff as we bring the data over
from the actual phone now that went
pretty fast but understand this is
because I just click the video that
process is going to take probably
anywhere from three to four hours if you
get all the data I've got here so just
be prepared to wait on that now we can
see we've got pretty much everything
that was on the phone even voice memos
we look here we can see voice memos we
can see that these are just recording
voice memos that we were made on this
phone and this error that doesn't mean
anything all that means there's not a
you know media player built into pair of
the plate but we can also see properties
of the device here such a serial number
here's a digital certificate the device
certificate and if you look down there's
also a public key offer digitally
signing stuff that was that was up in
the device there's also serial numbers
lots of different information here times
on information you know software
behavior key types even the the wireless
network cards mac address was just down
there but some more important
information we can look at map bookmarks
we can look at map history places that
this person has looked up via their map
application on the iphone we can also
see safari history here which is again
you know very forensically relevant
information we could see safari to spin
state we can also see notes we can see
call history SMS text history and arm
you know one of the things that I really
like here is this dynamic text because
this is text that that the the parent
really classified as one thing another
but it sorts it nicely and you can see
that this is clearly a message here that
was probably part of
email they got deleted or something of
that nature but as we scroll down you
can see that there's a wealth of
information be sim card information all
types of useful for linux beta here that
you cannot analyze you know here are
some notes these were information and
notes call history is included as well
including if you look there we can even
see duration of the calls now as i'm
clicking if you go over to the left I
just hit this order button it's going to
sort all of the data by type and that's
what these numbers are going down here
to sort every every object found by type
but you know notice as it's doing that
I'm still able to interact and do other
things as I collapse the phone numbers
there so that's one of the really cool
things about the way pair of approaches
forensics we don't have to wait for it
to finish its processing or finished
finished sorting for us to keep doing
other things for example we could even
go ahead and generate a report now if we
wanted to do that and I'm just going to
try to make it right over one that I've
got lots o it will fail because i don't
want to right over it but you know we
can see our report options and notice
are sorting to the left they're still
going on as i click through these
options and this is one of the really
really cool things i like about the way
paraben approaches mobile forensics
forensics in general as you know we need
to start looking at data immediately we
don't want to have to wait for the
program to finish sorting and parsing
and processing now you know i'm just
going to write an arbitrary name
actually i'll try to write / file that's
here and I've got the spiral locks it's
not going to be able to write over we're
going to save reporting for later
anyways I just wanted you to see how
easy it was to go through and say hey
spit me report out so of course it can
overwrite that one but that's just
that's as simple as it is for are you
know writing a report out now there's
lots of other great great features here
and notice as we're going
it's still sorting you know it's about
it's about 99% done but it's still
sorting this information by different
types and that makes it very useful for
you to go back and forensically not only
talk about but discuss as well so hey
guys hopefully you know this video's
gets excited about mobile forensics and
giving you some hope for mobile
forensics it's just starting to mature
but i'm starting to see good stuff out
there
I've works several cases and starting to
see some good output on that so thanks
for watching this