iPhone Forensics Without iPhone using iTunes Backup

1. Free
iPhone
Forensics
iPhone
Spy
Python
Program
-­‐
no
iPhone
needed
…remixed
http://www.uptill3.com/static/iphone_forensics.pdf
…

2. What
can
you
spy?
! Call
logs,
SMS
Messages,
Contacts,
Email,
Calendar,
Pictures,
Web
History
! Google
Maps,
GPS
Tracking
Info,
Passwords,
Facebook
data

3. 3
easy
steps
• View
pics,
1
2
3
• Find
iPhones
Facebook
info
hidden
data
• Extract
data
• iPhone
Spy
• Text
• In
iTunes
Programs
messages,
call
Backup
history
etc

4. Step
1

5. Locate
the
iTunes
Backup
files
for
iPhone

6. Find
Backup
data
location
iTunes
backups
of
the
iPhone
are
stored
in
the
following
directories:
! Windows
XP:
C:Documents
and
Settings(username)
Application
DataApple
ComputerMobileSync
Backup
! Windows
Vista:
C:Users(username)AppData
RoamingApple
ComputerMobileSyncBackup
! Mac
OS
X:
/Users/(username)/Library/Application
Support/MobileSync/Backup/

7. Look
for
these
iPhone
Backup
files
! Info.plist
–
information
about
the
iPhone,
owner
info
! Manifest.mdbd
and
Manifest.mdbx–
iTunes
9.2
has
changed
Manifest.plist
content
and
removed
the
.mdinfo
files
(and
dropped
the
extension
of
.mddata
files,
however
the
40
digit
key
is
the
same).
The
files
database
is
now
stored
in
a
couple
of
file:
Manifest.mbdb
and
Manifest.mbdx.
The
applications
list
remains
in
Manifest.plist.
! Manifest.plist
–
list
of
all
files
backed
up,
modification
time
and
hash
signature
! Status.plist
–
status
of
last
sync

9. Secret
Spy
Stuff

10. Contents
Real filename
Backup filename
SMS / Text messages
sms.db
3d0d7e5fb2ce288813306e4d4636395e047a3d28!
Contacts / address book
AddressBook.sqlitedb
adb8c77534444e97c31ff15924d50f3ed1fbd3b1!
Contacts / address book
AddressBook.sqlitedb
31bb7ba8914766d4ba40d6dfb6113c8b614be442!
Calendar
Calendar.sqlitedb
14ee8cdc3e6e0220399ff210246e1c92b7df89a0!
Calendar
Calendar.sqlitedb
2041457d5fe04d39d0ab481178355df6781e6858!
Notes
notes.db
740b7eaf93d6ea5d305e88bb349c8e9643f48c3b!
Notes
notes.sqlite
ca3bc056d4da0bbf88b5fb3be254f3b7147e639c!
Call history
call_history.db
a49bfab36504be1bf563c1d1813b05efd6076717!
Call history
call_history.db
ff1324e6b949111b2fb449ecddb50c89c3699a78!
Call history
call_history.db
2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca!
Locations
consolidated.db
4096c9ec676f2847dc283405900e284a7c815836!

11. Step
2

12. Now
that
you
found
iTunes
Backups

13. Extract
Hidden
Data

14. iPhone
Spy
Python
Program

15. You
can
search
computer
for
iTunes
Backups
by
selecting
option
1)

16. Let’s
spy
iPhone
Facebook
Friends
information
from
iTunes
Backups

17. iPhone
Spy
Python
program
is
extracting
Facebook
data
from
friends.db
hidden
in
the
iTunes
Backup

18. Step
3

19. Let’s
spy
on
the
hidden
Facebook
data
hidden
in
the
iTunes
Backup

20. Let’s
spy
on
John
Doe’s
Facebook
Data
on
this
users
iPhone

21. You
can
see
John
Doe’s
picture
by
using
this
URL

22. Free
iPhone
Forensics
in
3
easy
steps
Analyze
with
Spy
Facebook,
Find
iTunes
iPhone
Spy
SMS,
Pics
from
Backup
gadgets
iPhone
backup