Forensic Analysis of ios Device Backups

Transcription

1 Forensic Analysis of ios Device Backups ios Apple s mobile operating system Originally known as iphone OS Unveiled in 2007 Current version is 8.3, released April 8, 2015 ios Runs on: iphone ipod Touch ipad (and mini) Newest version runs on: iphone 4S and newer ipad 2 and newer ipad mini (all models) ipod Touch 5 th Gen 1

2 ios Device Backups What is a backup? Is a backup the same thing as a sync? ios Device Backups Why may a backup file be useful to us? Device is damaged Device is locked Device is missing Relevant data is no longer present on device The basic concept: ios Device Backups Locate machine to which the device was backed up Locate and extract backup files Examine backup files 2

3 ios Device Backups What utility is used to create ios device backups? itunes ios devices sync and backup using itunes itunes Free download Also serves as a driver for all ios devices for our forensic tools What types of data may be available to us in an ios backup file? SMS/MMS messages Call Logs Contacts Images Videos Calendar Notes Paired Bluetooth devices Voice memos s Location data Internet navigation data Social Networking data WiFi connection data Application data 3

4 ios Device Backups Of particular interest to us when examining application data: plist files Database files ios Backups Where are we going to get our backups? Target s computer icloud (we ll talk about this later) Where do we find ios backup files? On Windows Vista/7/8: C:\Users\USERNAME\AppData\Roaming\Apple Computer\MobileSync\ Backup On Windows XP C:\Documents and Settings\user\Application Data\Apple Computer\ MobileSync\Backup On Mac: ~/Library/Application Support/MobileSync/Backup/ 4

5 A word of caution Are we just going to turn on our target s computer and navigate to these locations and copy out our backup files? We must always use forensically sound practices to recover our data Target drive behind write blocker, forensic image, EnCase/FTK, etc. In order to see the backup files in their native location, we must be showing hidden files in Windows Here are the backups. What are those names? 5

6 You will sometimes encounter backups that have time/date stamps in the folder name, separate from the normal backup folders These occur when a device is restored from a backup We can also see the names of the individual ios devices within itunes under the Preferences itunes backups During the first backup, itunes makes a full backup of the device During subsequent backups of the same device, itunes will only overwrite files which have been modified since the last backup 6

7 itunes Let s look at a few of the options that are available under itunes that may be relevant to our investigation of backup files First, a look at the general user interface 7

8 Be aware that the user has the option of encrypting the backup file created by itunes 8

9 We ll discuss encrypted backups in a few minutes 9

10 What if we don t have the device (or it s locked), so we can t find the UDID from itunes? The UDID of the device will also be shown (along with other valuable information) in files within the backup folder info.plist manifest.plist We can open these in Notepad and examine their contents Here is our backup folder, removed from the suspect computer and copied onto ours: 10

11 info.plist, opened with Notepad And, a little further down: manifest. plist, opened with notepad 11

12 We ll look more closely at individual files in the backup folder in a bit Encrypted Backups Elcomsoft Phone Password Breaker 12

13 Once we have an un-encrypted backup, or have obtained the password, we have some options: Forensic Tools Oxygen Mobil Edit Etc. Budget Tools iphone Backup Extractor Etc. Manual Examination SQLite Manger add-on for Firefox Plist Editor Let s look at Oxygen Forensic Suite first 13

14 14

15 15

16 Oxygen Forensic Suite Now let s look at the backup file in Oxygen live Paraben s Device Seizure 16

17 17

18 18

19 19

20 Examining a backup in MobilEdit 20

21 21

22 22

23 23

24 Let s look at some more budget-friendly options 24

25 iexplorer ($35) Leawo ios Data Recovery ($70) ibackup Extractor ($25) 25

26 iphone Backup Extractor ($25) Exported SMS messages Exported call logs 26

27 All of the Notes are exported separately, as.html files Contacts are exported separately, as.vcf files Examination of backups using free tools 27

28 Manual examination of backups You don t have to have a fancy, expensive tool. Many files can be viewed using free utilities But, first, we have to figure out which files are which What type of file on a phone might be about 1.8MB? Let s open it in Notepad and look at the file header Time out What is the difference between a file extension and a file header? 28

29 5/28/2015 File Header Now we know what to open it with Here s a backup opened in EnCase; note the file header in the bottom left pane 29

30 So, as long as we can identify the file header, we can use an appropriate tool to open the individual files Yes, I know that might be tedious, but it s better than not getting the data, and cheaper than the fancy tools We can identify other files by their headers plists database files 30

31 plist Editor Pro (Lite version) 31

32 32

33 Firefox add-on 33

34 5/28/2015 DCode 34

35 Let s take a look at a couple of files from a backup using Plist Editor and SQLite Manager We have an investigation involving an ios device. How do we justify seizing a computer? Based on this officer s training and experience, as well as conversations with other officers with expertise in this area, I am aware that the majority of modern cell devices are capable of recording and storing digital images and videos. I am further aware that these images and videos can occupy significant portions of the memory available to these devices, and therefore, given the compatibility of these cellular devices and computer systems, as well as the ease of data transfer between the types of devices, both wired and wirelessly, it is common practice for users to archive these video and/or image files from the cellular device to a computer system for the purpose of freeing up memory on the cellular device, while still retaining the files. Additionally, I am aware that a large portion of modern cellular devices are designed to sync with a computer system, thereby ensuring that user data such as contacts, call logs, etc., can be restored to the cellular device in case of a software or hardware failure. These backup files which are thereby created on the computer system with which the cellular device is synced can contain data such as images and/or videos which were previously located on the cellular device, but no longer are, either through deletion, data corruption or device failure. It is, therefore, requested that any computer equipment located at the above location be seized and examined for data related to this investigation. icloud backups icloud is a cloud storage platform Apple provides for its users Each Apple device user (ios 5.0 or later) receives 5GB of free storage itunes gives us the option of backing up devices to the local machine or the icloud Additionally, users can back up directly to the icloud, without using itunes 35

36 What data is backed up to icloud? 36

37 How are we going to get the contents of an icloud account? What is available from an icloud account? What is available, cont. 37

38 Something to keep in mind So, in summation Backups are a great source of data for an ios device that is missing, broken or locked, or for data which may have previously been on a phone, but isn t any longer In order to examine a backup, we have to have the backup, which means we need to seize a computer (or serve a search warrant on the icloud) Summation, cont The majority of our good quality forensic tools do a very good job of examining backup files There are budget tools which will give us a more traditional (limited) set of data from the device If worse comes to worst (as it often does), the backup can be examined manually 38