Behind the Scenes of iOS Data Extraction: Exploring the Extraction Agent

Discover the benefits of agent-based data extraction from iOS devices. Learn about the purpose and development of the extraction agent, when it can be used, and best practices. Get a comprehensive understanding of the cutting-edge approach for iOS data extraction.

🧑‍💻 https://blog.elcomsoft.com/2023/02/behind-the-scenes-of-ios-data-extraction-exploring-the-extraction-agent/

Right Method, Wrong Order

In today’s digital age, extracting data from mobile devices is an essential aspect of forensic investigations. However, it must be done carefully and correctly to ensure the highest possible level of accuracy and reliability. To accomplish this, the appropriate extraction methods should be used in the right order, considering all available options for a given device running a specific version of the operating system. So what is the best order of extraction methods when acquiring an iPhone? Read along to find out.

🧑‍💻 https://blog.elcomsoft.com/2023/02/right-method-wrong-order/

#apple #ios #checkm8 #EIFT #EPB #EPV #mobileforensics #dfir

Building a Password Recovery Queue

In the previous article we discussed the different methods available for gaining access to encrypted information, placing password recovery attacks at the bottom of the list. Password recovery attacks are one of the methods used to gain access to encrypted information. In this article we’ll discuss the process of building a password recovery queue. Learn how to choose the appropriate workflow for the attack, the first prioritizing files with weaker protection, the second prioritizing faster and shorter attacks, and the third being a combination of the two. For your reference, we built a table to compare the relative strength of different file formats and encryption methods, helping users prioritize their attack queues.

🧑‍💻 https://blog.elcomsoft.com/2023/03/building-a-password-recovery-queue/

#password #dfir #EDPR

HomePod Forensics I: Pwning the HomePod

In this article, we will discuss how to access the hidden port of the first-generation HomePod and extract its file system image. Note that this process requires disassembly, voids the HomePod warranty, and requires specific tools, including a custom 3D-printable USB adapter, a set of screws, and a breakout cable. Therefore, this method is not recommended for casual users and should only be used by professionals who have a thorough understanding of the process.

🧑‍💻 https://blog.elcomsoft.com/2023/03/homepod-forensics-i-pwning-the-homepod/

#checkm8 #EIFT #HomePod #IoT #forensics

Elcomsoft iOS Forensic Toolkit 8.13 adds checkm8 extraction for first-generation HomePod

Elcomsoft iOS Forensic Toolkit 8.13 adds forensically sound checkm8 extraction support for first-generation HomePod devices, and brings multiple improvements to the handling of legacy iPhone models.

🧑‍💻 https://www.elcomsoft.com/news/830.html

#HomePod #iOS #EIFT #mobileforensics #dfir #checkm8

HomePod Forensics II: checkm8 and Data Extraction

The first-generation HomePod is a smart speaker developed by Apple that offers high-quality audio and a range of features, including Siri integration and smart home controls. However, as with any electronic device, it can store valuable information that may be of interest in forensic investigations. In this article, we will explore how to use the forensically sound checkm8 extraction to access data stored in the HomePod, including the keychain and file system image. We will also outline the specific tools and steps required to extract this information and provide a cheat sheet for those looking to extract data from a HomePod. By the end of this article, you’ll have have a better understanding of how to extract data from the first-generation HomePod and the potential limitations of this extraction method.

🧑‍💻 https://blog.elcomsoft.com/2023/03/homepod-forensics-ii-checkm8-and-data-extraction/

#iOS #checkm8 #HomePod #EIFT #DFIR #mobileforensics

Perfect Acquisition Part 1: Introduction

Forensic acquisition has undergone significant changes in recent years. In the past, acquisition was relatively easy, with storage media easily separable and disk encryption not yet widespread. However, with the rise of mobile devices and their built-in encryption capabilities, acquiring data has become increasingly challenging. Traditional approaches like disk dumps are no longer feasible, and software exploitation has become the industry standard. Despite these methods, there are limitations to mobile acquisition, including the need to collaborate with the device, the possibility of hardware defects or deliberate data tampering. As a result, there is a need for continuous innovation in forensic acquisition to address these challenges and ensure accurate and reliable data collection.

🧑‍💻 https://blog.elcomsoft.com/2023/03/perfect-acquisition-part-1-introduction/

#ios #legacy #lowlevelextraction

Perfect Acquisition Part 2: iOS Background

Welcome to part 2 of the Perfect Acquisition series! In case you missed part 1, make sure to check it out before continuing with this article. In this section, we will dive deeper into iOS data protection and understand the obstacles we need to overcome in order to access the data, which in turn will help us accomplish a Perfect Acquisition when certain conditions are met.

🧑‍💻 https://blog.elcomsoft.com/2023/03/perfect-acquisition-part-2-ios-background/

#iOS #lowlevelextraction #dfir #mobileforensics