Itunes-forensic guys ' best friend

What chances does think to acquire suspect's data from his/her iDevice? If suspects also use ITunes or ICloud, I'll say it's in the bag.

What ' s inside a seized iPhone? Suspect refused to tell us and he is very confident that no one could unlock his iPhone.

Fortuneately we got suspect ' s Laptop and found our best friend "ITunes". Why is iTunes your best friend? Because when your connect your iDevice to the Pc/mac/laptop with itunes installed, itunes would sync and backup data from ID Evice. The "secret" is the plist in the Lockdown folder. If you got the plist of suspect ' s iDevice, you could take advantage of it to establish "Trust" relationship between your Forensic workstation and suspect ' s iDevice. Of course a plist file corresponds to certain iDevice.

Copy those plist files to the Lockdown folder on forensic workstation, and connect suspect ' s iPhone to the forensic Workst ation. The Magic works~ you don ' t has to press any buttion on that iPhone. The "Trust" relationship is already there. Now we could use ITunes to backup data from suspect's iphone, and we don ' t need to unlock supsect ' s iphone. After backup completed, you could got everything in suspect's iPhone now.

Congraulations!!! Even you don ' t has any forensic tools, and you could the use of iTunes to restore this backup file to another iPhone. So you'll know whether there is any clue or not.

Never doubt that~ even you use commercial mobile forensic tool, the secret is still the plist file.

Itunes-forensic guys ' best friend