i: Phone and i: OS Forensics. Investigation, Analysis and Mobile Security for Apple i: Phone, i: Pad and i: OS Devices

309 Pages·2011·16.32 MB·English

by  Andrew Hoog And Katie Strzempka (Auth.)

iPhone and iOS
Forensics
iPhone and iOS
Forensics
Investigation, Analysis
and Mobile Security for Apple
iPhone, iPad, and iOS Devices
Andrew Hoog
Katie Strzempka
Technical Editor
Robert Maxwell
AcquiringEditor:AngelinaWard
DevelopmentEditor:HeatherScherer
ProjectManager:JessicaVaughan
Designer:EricDeCicco
SyngressisanimprintofElsevier
225WymanStreet,Waltham,MA02451,USA
#2011Elsevier,Inc.Allrightsreserved.
Nopartofthispublicationmaybereproducedortransmittedinanyformorbyanymeans,
electronicormechanical,includingphotocopying,recording,oranyinformationstorageand
retrievalsystem,withoutpermissioninwritingfromthepublisher.Detailsonhowtoseek
permission,furtherinformationaboutthePublisher’spermissionspoliciesandour
arrangementswithorganizationssuchastheCopyrightClearanceCenterandtheCopyright
LicensingAgency,canbefoundatourwebsite:www.elsevier.com/permissions.
Thisbookandtheindividualcontributionscontainedinitareprotectedundercopyrightby
thePublisher(otherthanasmaybenotedherein).
Notices
Knowledgeandbestpracticeinthisfieldareconstantlychanging.Asnewresearchand
experiencebroadenourunderstanding,changesinresearchmethodsorprofessionalpractices,
maybecomenecessary.Practitionersandresearchersmustalwaysrelyontheirown
experienceandknowledgeinevaluatingandusinganyinformationormethodsdescribed
herein.Inusingsuchinformationormethodstheyshouldbemindfuloftheirownsafetyand
thesafetyofothers,includingpartiesforwhomtheyhaveaprofessionalresponsibility.
Tothefullestextentofthelaw,neitherthePublishernortheauthors,contributors,oreditors,
assumeanyliabilityforanyinjuryand/ordamagetopersonsorpropertyasamatterofproducts
liability,negligenceorotherwise,orfromanyuseoroperationofanymethods,products,
instructions,orideascontainedinthematerialherein.
LibraryofCongressCataloging-in-PublicationData
Hoog,Andrew.
iPhoneandiOSforensics:investigation,analysis,andmobilesecurityforAppleiPhone,
iPad,andiOSdevices/AndrewHoog,KatieStrzempka.
p.cm.
Includesindex.
ISBN978-1-59749-659-9
1. iPhone(Smartphone)2. iPad(Computer)3. iOS(Electronicresource)4. Datarecovery
(Computerscience) I.Strzempka,Katie.II.Title.
QA76.8.I64H6652011
005.8’6–dc23
2011013050
BritishLibraryCataloguing-in-PublicationData
AcataloguerecordforthisbookisavailablefromtheBritishLibrary.
ISBN:978-1-59749-659-9
PrintedintheUnitedStatesofAmerica
11 12 13 14 15 10 9 8 7 6 5 4 3 2 1
ForinformationonallSyngresspublicationsvisitourwebsiteatwww.syngress.com
Acknowledgments
Whenmakingthedecisiontoco-authorthisbook,Iwaswellawareoftheimpactit
was going to have on my life, but did not fully realize all of the others that would
be directly or indirectly involved. Luckily, I have this section to show my
appreciation.
I must first thank my family and friends for being so understanding on those
many nights and weekends where I was M.I.A. Specifically...thanks to my dad
for editing Chapter 2, even though “the Linux stuff was kind of way over my
head,” and to my mom for always trying to convince me that I am way smarter
than I actually am. Thank you to my brother, Danny, for caring for my dog when
I was unable to. Jill, thank you for your encouragement throughout the entire pro-
cess,especiallywhenitinvolvedcupcakesfilledwithcookiedough.Anadditional
thank you to my friends for convincing me to take occasional breaks to eat sushi
and play darts.
To Dr. Marcus Rogers and Purdue’s Cyber Forensics program: thank you for
helping me prepare for a career in this field and to continue to advise me on pro-
fessional decisions.
IalsooweagreatdealofgratitudetotheviaForensicsfolks,mainlyforputting
upwithAndrewandmyconstanttalkofthe“wordcountmeter.”BigthankstoTed
forhisabilitytoconcatenatemyiPhonesimulatorphotos,Catherineforlettingme
ventonadailybasis,andChrisforforcingmetoinventnewwaysofanalyzingthe
iPhone, even when I laughed at him and said, “there is NO WAY we can recover
those videos!”
This book would not have been completed without the help of my co-author,
Andrew Hoog, who has taught me that everything can and should be done using
command line (even if there is a GUI that can do it 10 times faster).
ix
Preface
This book is intended for individuals who are interested in the iPhone and other
iOS devices and, more importantly, in the type of data that is stored and can be
recoveredfromthesedevices.Thedemandformobileforensicshasgrowntremen-
dously with the release of smart phones. Communication on these devices is now
documented because people are no longer using their phones for just talking.
Whether people use their iOS devices to send text messages, check their personal
and work e-mail, browse the Internet, manage their finances, or even take photos
and videos, what they do not realize is that this data is being stored on their
devices. When they delete a piece of information, it is expected that data is gone
forever. This book not only explains why this data can still be recovered but also
providesdetailedmethodsonhowaforensicexaminercanextractthisinformation
from an iOS device.
Thebookisorganizedinamannerthatallowsthereadertoindependentlyfocus
ononechapteratatime.IfaCorporateSecurityOfficerisonlyinterestedinwhether
the data stored on an iPhone or iPad is secure, he or she can jump straight to
Chapter4–iPhoneDataSecurity.Ifanexperiencedmobileforensicexaminerunder-
standsallthefilesstoredwithintheiPhone’sfilesystembutisinterestedinlearning
moreaboutsomeadvancedanalysistechniques,heorshecanskipthroughthefirst
fewchaptersandfocusonChapter6–DataandApplicationAnalysis.
The following paragraphs contain a brief summary of each of the chapters.
Chapter 1 provides an overview of the iPhone, including a timeline of events
leading up to its development. Details related to the various models are outlined,
including a definition of many of the hardware components within the device.
The forensic acquisition of an iPhone device is introduced by defining the various
waysinwhichdatacanbeextracted.Thechapterconcludeswithanintroductionto
Linux,showinghowtheuseofthesecommand-linetoolscanbeextremelypower-
ful in a mobile examination.
Chapter 2 introduces many of the popular Apple devices running iOS, as well
asthefeaturesuniquetothesedevices.Softwareupdates,anintroductiontodevice
security,andthevariousoperatingmodesareamongthetopicscovered.Alsocov-
ered are techniques describing the performance of system upgrades and down-
grades and booting of the devices into different operating modes. The interaction
betweeniTunesandaniOSdeviceisdiscussed,includingthefunctionsitprovides
to support these iOS devices.
Chapter3discussesthetypeofdatathatisstoredontheiPhone,thegeneralloca-
tionsofthisdatastorage,andtheformat.CommonfiletypesrecoveredfromaniOS
devicearedescribedindetailinordertoprovidetheexaminerwithanunderstanding
of how the data is stored so that he or she can more efficiently recover data from
thesefiles.ThetypeofmemorycontainedonaniPhoneisalsooutlined,inaddition
totheoperatingsystem,filesystem,anddiskpartitionscontainedonthedevice.
iPhoneandiOSForensics xi
©2011ElsevierInc.Allrightsreserved.
xii Preface
Chapter 4 provides mobile device administrators within companies options on
the protection of user data. The reader is walked through the process involved in
the testing of these Apple devices in an effort to determine the type of sensitive
data that can be recoveredfrom them. Also covered inthis chapter isthe develop-
ment of secure mobile applications, strongly encouraging testing from both the
useranddeveloperperspective.Finally,somegeneralrecommendationsfordevice
and application security are provided, allowing users and administrators to proac-
tively secure the devices used within their company.
Chapter5coversthevarioustypesofforensicacquisitionsthatcanbeperformed
ontheiPhone,iPad,andotheriOSdevices.Theimportanceofforensic imagingis
discussed, followed by an explanation of the different ways in which a device can
be imaged. Two different methods of data retrieval through the iPhone’s backup
files are stepped through in detail; this is followed by a logical acquisition and,
finally, a physical extraction of the device. The possibility of imaging other iOS
devices,includingtheiPodTouchandAppleTV,isalsooutlined.
Chapter6encompassestheanalysisofthedatacontainedonaniPhone.Itstarts
out by introducing the reader to several different analysis techniques. Some basic
methods are discussed, such as the mounting of a disk image, as well as more
advanced techniques including the analysis of an image within a hex editor. Prac-
tical scenarios are applied for each technique in order to show an examiner all the
stepsneededtoduplicatethecommand.Followingtheanalysistechniques,thefile
systemlayoutisdiscussed.Fromthissection,thereadercangainanunderstanding
of the location of each type of data. The chapter concludes with a mobile app ref-
erencesection.Here,examinerscanlookthroughalistofspecificapplicationsand
learn where the data for each is stored.
Chapter 7 covers the use of various mobile forensic acquisition tools, showing
how they compare with one another. The data population process, which involves
the preparation of an iPhone test device, is outlined. The methodology used for
testingisexplainedindetail,followedbyanoverviewofeachofthesoftwarepro-
ductsusedforanalysis.Asignificantportionofthischapterisdevotedtoanexam-
ination of the test device using each of the tools listed. From start to finish, the
reader is stepped through the installation, acquisition, and analysis, as well as a
final table for each section contains the findings for that particular tool.
WEBSITE
For companion material including code, programs, and updates, please visit:
http://viaforensics.com/education/iphone-ios-forensics-mobile-security-book/
About the Authors
AndrewHoogisacomputerscientist,certifiedforensicanalyst(GCFAandCCE),
computer and mobile forensics researcher, former adjunct professor (assembly
language),andownerofviaForensics,aninnovativecomputerandmobileforensic
firm. He divides his energies between investigations, research, and training about
the computer and mobile forensic discipline. He writes computer/mobile forensic
how-to guides, is interviewed on radio programs, and lectures and trains both cor-
porationsandlawenforcementagencies.AstheforemostexpertinAndroidForen-
sics, he leads expert-level training courses, and speaks frequently at conferences.
Katie Strzempka is a technology consultant with viaForensics, a computer and
mobile forensics firm. She performs forensic investigations, security audits and
research, and has trained investigators around the world in mobile forensics. She
isalsoaco-authorforawhitepaperoniPhoneForensics,ananalysisofthevarious
iPhone Forensics commercial tools. Ms. Strzempka received her Master’s degree
fromPurdueUniversityinCyberForensicsandhasaB.S.inComputerandInforma-
tionTechnology.PriortoworkingforviaForensics,sheworkedfor3yearsinInfor-
mation Security for a Fortune 500 company, handling firewall administration and
assistingwithinternalandexternalnetworkconnectivity.
xiii
iPhoneandiOSForensics
©2011ElsevierInc.Allrightsreserved.
About the Technical Editor
RobertMaxwellistheLeadIncidentHandlerforUniversityofMaryland(UMD),
CollegePark,andtheFounderandManagingDirectoroftheDigitalForensicsLab
at UMD, focused on education and curriculum development. He also coaches
UMD’s competitive CyberSecurity team, and is a Senior Contributor to Byte
magazine. He lives with his wife and two children in bucolic Damascus, MD.
iPhoneandiOSForensics xv
©2011ElsevierInc.Allrightsreserved.
CHAPTER
1
Overview
CHAPTER POINTS:
(cid:129) iPhoneModels
(cid:129) ForensicExaminationApproaches
INTRODUCTION
Mobile devices have come a long way over the past few years. For a while, cell
phones were simply used for making phone calls. As they continued to mature,
the capability to send and receive text messages, create calendar events, and save
contacts became readily available. Fast forward to the present day, and mobile
devicesarenowbeingusedextensivelyandservemanypurposes.Around4.6billion
individuals owned cell phones as of early 2010, and the number was expected to
reach5billionbytheendoftheyear(CBS,2010).Withthisincreaseinpopularity
came an enormous demand for mobile forensics.
The iPhone was first released to consumers in June 2007. Ever since the first
release,thedevicehasincreasinglygainedinpopularity,partlyduetoitsadvanced
functionalityandusability.WiththeiPhone,individualsnowhavethecapabilityto
checke-mail,takephotos,browsetheInternet,anddomuchmore.Theseactivities
maketheiPhonetaketheplaceofpersonalcomputers(PCs)anddigitalcameras.In
additiontothestandardcapabilitiesthatexistintheiPhone,endlessapplicationsare
also available for download to assist with finances or organization, or simply for
entertainment.
Inthelate1980s,theNewtonplatformwasthecompany’smainfocus.Thisplat-
formwasapersonaldataassistant(PDA),whichneverreallytookoff.Theproject
ultimatelyfailedin1998.Oneyearpriortothat,SteveJobsbecametheCEOofthe
company. Before the idea of the iPhone was actually formulated, Jobs decided to
haveApplestartfocusingontheideaoftouch-screendevelopmentratherthanPDAs
andtabletPCs.Believingthatcellulardevicesweregoingtobecomeverypopular,
the company began developing a mobile device that could display pictures and
videosandwouldultimatelyhavethecapabilitytosyncwithiTunes.OnNovember
2006, a patent was granted for the Apple iPhone, and in January 2007 Jobs
announced the release ofthe iPhone at MacWorld (Wired, 2008).
iPhoneandiOSForensics 1
©2011ElsevierInc.Allrightsreserved.
2 CHAPTER 1 Overview
Strategy
Apple’sstrategyoverthepastfewyearshasshiftedawayfromtraditionalcomputing.
New and innovative ideas have been developed, disrupting the existing business
model.Inthemusicandvideogenre,severaldifferentapplicationsanddeviceshave
beendevelopedincludingtheAppleTV,iTunes,andvariousiPoddevices.Themobile
categoryincludestheiPhone,whiletheclassofdeliverychannelitemsincludesboth
iTunes for synchronization and downloads and the App Store. Finally, the develop-
mentoftheiPad(andpreviouslytheNewtondevice)fallswithintheTabletcategory.
ManyofthesenewerdeviceshavebeenconsolidatedontotheiOSplatform,withthe
exceptionoftheMacintoshworkstations,whicharerunningOSX.Therehasbeensome
debateinthepastonwhetherMacOSXwilltransformtoiOSorperhapsaplatformmore
similar to iOS. The Mac OS X Lion is to be released in the summer of 2011. This
operatingsystemissaidtohavesimilarqualitiesastheiOSdevices,withtheexception
ofatouch-screenfeature.AMacAppStorewasreleasedinJanuaryof2011,which
enables Mac users to purchase software straight from their computer, similar to the
wayapplicationscanbepurchasedthroughtheiTunesAppStore(AppleInc.,2010).
As of 2009, the iPhone had taken third place in smart phone sales worldwide,
whichconstituted4.4%ofthemarketshare(McGlaun,2010).Duringthefirstquarter
of2010alone,8.75millionweresold,whichwasmorethanhalfthenumberforthe
sameperiodin2009.JustpriortothereleaseoftheiPhone4,over50millioniPhones
had been sold,andstatistics fromQ42010 show thatApple controlled25%of the
smartphonemarketintheUnitedStates(Slashdot,2011).Withtheextremepopu-
larityoftheiPhoneandtheincreasingnumberofdevicessold,thismobiledevicehas
becomeone ofthe mainfocalpoints ofmanyforensic investigations.
Development community
Apart from sales, the iPhone has an active hacking community, which has yielded
researchandtoolsthatsupportforensicinvestigations.Someofthesetoolsandtech-
niqueswereoriginallyusedtoassistwithforensicimagingandarecurrentlyusedfor
testinginordertobetterunderstandthedevice.Cydiaisapopularapplicationused
forthesepurposes.ItallowsuserswithamodifiedphonetodownloadandruniPhone
oriPadapplicationsthatarenotavailableintheAppStore.Morespecifically,appli-
cationscanbefoundherethatmayallowanexaminertobetterunderstandtheiPhone
filesystemandotherdatacontents,suchasMobileTerminal.Jailbreaking,ormodi-
fyinganAppledevice,isnotsuggested,asitisnotaforensicallysoundmethod;how-
ever, having the capability to remotely connect to a test device for educational
purposes can be aninvaluable learning experience for an examiner.
AnothertechniquethatiscommonlyusedontheiPhoneisreferredtoas“unlock-
ing.”From2007toearly2011,AT&Twastheonlyproviderthatofferedserviceforthe
iPhoneintheUnitedStates.Inordertofunctionproperly,anAT&TSIM(subscriber
identitymodule)cardhadtobeplacedintothedevicetoidentifyitselfonthecarrier’s
network. In February 2011, the iPhone 4 became available through another carrier,
Verizon. With the device being so exclusive and only available under these two