Bedford, March 2020

Data acquisition from iOS devices.
New approaches and possibilities.
Extracting evidence from a seized iPhone:
Using the latest exploits© Elcomsoft s.r.o. www.elcomsoft.com

1

iOS Forensics
In This Talk
Physical acquisition at a glance§ Hardware and software limitations§ Pros and cons
Latest exploits and solutions§ Classic jailbreaks§ Rootless jailbreak§ Checkm8 and Checkra1n§ Data acquisition in BFU mode
§ Full File System acquisition
2iOS Forensics
Acquisition Methods That Don’t Work§ Some acquisition methods common on otherplatforms are not available for iOS§ JTAG: there is no test access port (but technicallyUSB port can be used)§ Chip-off: full-disk encryption makes offline attacks
completely useless3

Acquiring data from iOS device
Situation before the end of 2019§

Physical acquisition: available for old devices only (with 32-bitCPUs)§

Passcode brute-force is available for old devices§

On newer devices, jailbreak is required§

Passcode must be known or recovered (using GrayKey orsocial engineering)§No jailbreak for certain versions of iOS§

Jailbreaks leave very many traces, corrupt system files andcan “brick” the device§

USB restriction mode (iOS 11.4.1, July 2018) blocks all wired
connections when the device is locked4

Acquiring data from iOS device
Classic jailbreak: Issues§ Jailbreak has many forensic implications§ Dangerous, no guaranteed outcome§ Not forensically sound, introduces artifacts§ Process must be carefully documented§ Semi-tethered jailbreaks expire in 7 days
(unless Apple Developer account is used)§ Cydia Impactor does not work with personalaccounts anymore§ Each Apple Developer account can be usedto sign IPA files to jailbreak a limited numberof devices

5Jailbreaks for iOS
What iOS jailbreak actually does
§ Escalates privileges of user, allowing:§ Download, install and run any application, including
unsigned ones
§ Access all application sandboxes (many viruses
exist for jailbroken iOS devices)§ In some cases access to all system files including
kernel6

Jailbreaks for iOS
Classic jailbreak§ Allows access to the root of device file system – “/”§ Requires to remount file system to gain access to /§ Modifies many system files§ OTA iOS update becomes impossible§ Leaves very many traces§ In some cases device is unstable until full restore withiTunes7

Jailbreaks for iOS
Rootless jailbreak§ “Rootless” does not mean “without root access”, it means“without access to the root of file system”§ Can be applied offline with developer account§ File system is accessible from /var folder§ Modifies only files inside /var
§ Leaves significantly less traces than classic JB§ System is more stable§ Rootless jailbreaks are more forensically sound thanclassic ones8

Jailbreaks for iOS
Checkm8 hardware exploit§ Was introduced at September 27, 2019
§ Uses exploit in CPU hardware (boot ROM)
§ Cannot be patched by Apple at all§ Supports Apple CPUs from A5 to A11§ Supports iOS devices with ANY iOS version§ All devices from iPhone 4S to iPhone X arevulnerable

9Jailbreaks for iOS
Checkra1n jailbreak§ Uses checkm8 exploit§ Device must in DFU mode to apply jailbreak§ Cydia Impactor is not required§ USB port is always accessible in DFU mode. No
USB restriction mode.
§ Many files and databases can be acquired in BFU(before first unlock) state§ Cannot recover device passcode§ Any acquisition tool can be used to extract the entire
file system of device
10Data acquisition in BFU mode
What data is available Before First Unlock§ List of installed applications§ Some Wallet data
§ Media files§ Wi-fi connections§ Notifications§ Some location points§ Unprotected records of Keychain

11

Jailbreaks for iOS
Checkra1n jailbreak: cons
§ Many system files are modified by jailbreak – notforensically sound§ Most modifications are not required for file systemextraction§ Certain versions put device in USB restricted mode
after reboot from DFU§ iOS 13.4 beta allows DFU mode only with fulldevice wipe

12

Jailbreaks for iOS
Using EIFT with checkra1n jailbreak13

Forensic usage of jailbreak
What jailbreak features we don’t need
System modification

Cydia install
OTA updates disable

SSH and other apps

All we need is:
Full file system
14

FFS Acquisition with agent
Full File System acquisition – acquire data without jailbreak§ Most features of jailbreak are not required for forensicacquisition§ ANY jailbreak is not forensically sound, leaves many
traces and makes many changes§ ANY jailbreak can “brick” the device§ All we need is access the device file system andextract Keychain

15

FFS Acquisition with agent
Full File System acquisition – acquire data without jailbreak§ Agent (IPA file) is signed by developer’s certificate anduploads to device§ Agent is launching on the device§ Agent exploits system kernel to get file system access§ Connected PC initiates file transfer from agent§ Files are packed in TAR archive§ Keychain can be acquired§ Agent can be deleted from the device§ Leaves only some records in system logs16

FFS Acquisition with agent
Full File System acquisition – limitations§ Device must be unlocked§ Device passcode must be known§ Certain versions of iOS are not supported§ Certain device models are not supported

17

FFS Acquisition
Using EIFT for FFS

18

Methods of data acquisition
MethodHardwareiOSversions

RootaccessTracesReliability

Physical

32-bit CPU only:
iPhone – iPhone 5C

Up to iOS 7

Yes

NoReliable, data is acuired in DFU
mode

Classic
jailbreakAll devices

Up to 12.4,
13.0 – 13.3

Yes

A lot of traces: manyapplications are installed,
system files are modified.

System files modification can“brick” device

Rootlessjailbreak

All A7-A11 devices:
iPhone 5S – iPhone X

iOS 11-12

NoFew. Only SSH app isinstalled, does not modify
system files at all

Reliable, only /var folder ismodified

Checkra1n

iPhone 5S – iPhone X

iOS 12.3 –13.3.1Yes

As classic JB

Reliable in most cases, butsometimes “bricks”the device

FFS

All devices

Up to 12.4,
13.0 – 13.3

Yes

Few. Only some records insystem logs

Reliable. Doesn’t install
applications, doesn’t modify
system files.

19

20

21

22

Elcomsoft Mobile Forensic Bundle
Our complex solution for mobile forensics§ Acquisition from iOS devices with installed Jailbreak(checkra1n is supported)§ Full file system acquisition with agent§ Decrypt and analyze iTunes backups§ Download iCloud backups (all iOS versions and 2FA aresupported)§ Download iCloud synchronized data
§ Download from Google cloud§ Convenient viewer to explore acquired data23

Official web site:
https://www.ELCOMSOFT.com

Technical blog:
https://BLOG.elcomsoft.com“Why Mobile Forensic Specialist Need a Developer Account with Apple”

24Data acquisition from iOS devices.
New approaches and possibilities.

(c) ElcomSoft 2020
ElcomSoft Co. Ltd.
http://www.elcomsoft.com
http://blog.elcomsoft.com
Facebook: ElcomSoft
Twitter: @elcomsoft25