iPhone Forensics Without iPhone using iTunes Backup

16,549 views

Published on

iPhone Forensics Without iPhone using iTunes Backup

Published in: Technology
0 Comments
2 Likes
Statistics
Notes
  • Be the first to comment

No Downloads
Views
Total views
16,549
On SlideShare
0
From Embeds
0
Number of Embeds
10
Actions
Shares
0
Downloads
0
Comments
0
Likes
2
Embeds 0
No embeds

No notes for slide

iPhone Forensics Without iPhone using iTunes Backup

  1. 1. Free  iPhone  Forensics  iPhone  Spy  Python  Program  -­‐  no  iPhone  needed   …remixed  http://www.uptill3.com/static/iphone_forensics.pdf  …    
  2. 2. What  can  you  spy?  !  Call  logs,  SMS  Messages,   Contacts,  Email,  Calendar,   Pictures,  Web  History  !  Google  Maps,  GPS  Tracking   Info,  Passwords,  Facebook  data  
  3. 3. 3  easy  steps   • View  pics,  1   2   3   • Find  iPhones   Facebook  info   hidden  data   • Extract  data   • iPhone  Spy   • Text   • In  iTunes   Programs   messages,  call   Backup   history  etc  
  4. 4. Step  1  
  5. 5. Locate  the  iTunes  Backup  files  for  iPhone  
  6. 6. Find  Backup  data   location  iTunes  backups  of  the  iPhone  are  stored  in  the  following  directories:  !   Windows  XP:    C:Documents  and  Settings(username) Application  DataApple  ComputerMobileSync Backup  !   Windows  Vista:  C:Users(username)AppData RoamingApple  ComputerMobileSyncBackup  !   Mac  OS  X:  /Users/(username)/Library/Application   Support/MobileSync/Backup/  
  7. 7. Look  for  these  iPhone   Backup  files    ! Info.plist  –  information  about  the  iPhone,  owner  info  ! Manifest.mdbd  and  Manifest.mdbx–  iTunes  9.2  has  changed   Manifest.plist  content  and  removed  the  .mdinfo  files  (and   dropped  the  extension  of  .mddata  files,  however  the  40  digit   key  is  the  same).  The  files  database  is  now  stored  in  a  couple  of   file:  Manifest.mbdb  and  Manifest.mbdx.  The  applications  list   remains  in  Manifest.plist.  ! Manifest.plist  –  list  of  all  files  backed  up,  modification  time  and   hash  signature  ! Status.plist  –  status  of  last  sync  
  8. 8. Secret  Spy  Stuff  
  9. 9. Contents Real filename Backup filenameSMS / Text messages sms.db 3d0d7e5fb2ce288813306e4d4636395e047a3d28!Contacts / address book AddressBook.sqlitedb adb8c77534444e97c31ff15924d50f3ed1fbd3b1!Contacts / address book AddressBook.sqlitedb 31bb7ba8914766d4ba40d6dfb6113c8b614be442!Calendar Calendar.sqlitedb 14ee8cdc3e6e0220399ff210246e1c92b7df89a0!Calendar Calendar.sqlitedb 2041457d5fe04d39d0ab481178355df6781e6858!Notes notes.db 740b7eaf93d6ea5d305e88bb349c8e9643f48c3b!Notes notes.sqlite ca3bc056d4da0bbf88b5fb3be254f3b7147e639c!Call history call_history.db a49bfab36504be1bf563c1d1813b05efd6076717!Call history call_history.db ff1324e6b949111b2fb449ecddb50c89c3699a78!Call history call_history.db 2b2b0084a1bc3a5ac8c27afdf14afb42c61a19ca!Locations consolidated.db 4096c9ec676f2847dc283405900e284a7c815836!
  10. 10. Step  2  
  11. 11. Now  that  you  found   iTunes  Backups  
  12. 12. Extract  Hidden  Data  
  13. 13. iPhone  Spy  Python  Program    
  14. 14. You  can  search  computer  for  iTunes  Backups  by  selecting   option  1)  
  15. 15. Let’s  spy  iPhone  Facebook   Friends  information  from   iTunes  Backups  
  16. 16. iPhone  Spy  Python  program   is  extracting  Facebook  data  from  friends.db  hidden  in  the   iTunes  Backup  
  17. 17. Step  3  
  18. 18. Let’s  spy  on  the  hidden  Facebook  data   hidden  in  the  iTunes   Backup    
  19. 19. Let’s  spy  on  John  Doe’s  Facebook  Data  on  this  users   iPhone  
  20. 20. You  can  see  John  Doe’s  picture  by  using  this  URL  
  21. 21. Free  iPhone  Forensics  in   3  easy  steps   Analyze  with   Spy  Facebook,   Find  iTunes   iPhone  Spy   SMS,  Pics  from   Backup   gadgets   iPhone  backup  

×