Ios 8 – What It Changes for Forensic Investigators
iOS 8 – What it Changes for Forensic Investigators This appendix shows the current status, as of February 2015, of the ongoing research related to the possibilities of forensic examination of a device with the iOS 8 operating system. The first aspect toconsider is the detail of the devices that support this version of the operating system. As for the iPhone, the supported models are all those starting from 4s (that is, 4s, 5, 5c, 5s, 6, and 6 Plus), while regarding the iPad, the supported models are all those from the iPad 2 (that is, 2, 3, 4, Air, Air 2, Mini, Mini 2, and Mini 3). The second aspect of interest is related to the types of acquisitions that are possible. At present, it is not possible to engage in physical acquisition of non-jailbroken devices. From a hardware point of view, as explained in the book, are unknown exploits at the bootrom level, and therefore it is not possible to inject an alternative operating system from which we make this type of activity. Instead, techniques for jailbreaking of iOS 8 devices are already known and available (that is, Taigu and Pangu). The company Elcomsoft, released in January 2015 a new version of its tool iOS Forensic Toolkit for the acquisition of 32-bit devices already jailbroken and with iOS 8 operating system (more information is available at www.elcomsoft.com/news/592.html). It only works with devices jailbroken with Taigu and it is important to remark that this jailbreak tool requires that the Find My Phone feature is disabled; otherwise, it is not possible to jailbreak the device.
[Show full text]