Embedded Files
1. Solvable:
1. Solvable:
Problems:
Problems:
Problem #1: Inability to do passcode/pattern code bypass
Problem #1: Inability to do passcode/pattern code bypass
- Android phone was on version 6.0.1
- Pattern bypass was only supported up till 4.4
- Due to versions being too high and unsupported
Problem #2: Unsupported or deprecated iOS versions
Problem #2: Unsupported or deprecated iOS versions
- iOS versions being
- iOS 8.4.1 on the iPhone 4S
- Due to this, we are unable to test a few important applications such as
- Gmail
- Etc.
Problem #3: Initially unable to update the Cellebrite UFED TOUCH 2 from V5 to V7 due to the missing bin file in the update package
Problem #3: Initially unable to update the Cellebrite UFED TOUCH 2 from V5 to V7 due to the missing bin file in the update package
Problem #4: There was only 1 licence key, so unable to analyze the data using both computers
Problem #4: There was only 1 licence key, so unable to analyze the data using both computers
Solutions:
Solutions:
Solution #1 For Problem #1:
Solution #1 For Problem #1:
Was still able to retrieve the password or pin using physical (boot-loader) extraction using the Cellebrite UFED TOUCH 2 V7
Solution #2 For Problem #2:
Solution #2 For Problem #2:
By using the other devices, like iPad 4 to download some of these applications
Solution #3 For Problem #3:
Solution #3 For Problem #3:
[See below for the complete steps to update the Cellebrite UFED TOUCH 2] There was limited documentation on how to properly do the updating of the Cellebrite UFED TOUCH 2 from V5 to V7 (attached below). In addition, the prompt by the Cellebrite UFED TOUCH 2 is ambiguous, but we found out that the BIN file was actually located within the CPKG file. Refer to Steps To Update UFED TOUCH 2 to V7.8.0.942 section below...
RESEARCH - Installing_CPKG_File.pdfRESEARCH - Installing_CPKG_File.pdf
Solution #4 For Problem #4:
Solution #4 For Problem #4:
We found a UFED Reader that was available on the Cellebrite Portal that allows you to read the report generated from UFED Physical Analyzer
Steps To Update UFED TOUCH 2 to V7.8.0.942
Steps To Update UFED TOUCH 2 to V7.8.0.942
Step 1:
Step 1:
Download the latest version cpkg file from the Cellebrite Portal (Either one Highlighted below), but for our case we downloaded UFED Touch2 for CMS Distribution 7.8 (Jul. 2018) package
Step 2:
Step 2:
Once download has completed, unzip the file
Step 3:
Step 3:
Locate the cpkg file
Step 4:
Step 4:
right click the cpkg file and open with winRAR
Step 5:
Step 5:
extract and copy both bin files into the USB flash drive in the root folder
Step 6:
Step 6:
Plug the USB flash drive with the files into the Cellebrite UFED TOUCH 2
Step 7:
Step 7:
Press settings on the navigation bar on top
Step 8:
Step 8:
Now you are at the General Settings
Step 9:
Step 9:
Go to the versions tab, on this tab click on USB and it should locate the files directly
Step 10:
Step 10:
Select the package and click install package
Step 11:
Step 11:
Wait for the update to complete (should consists of a windows update and multiple reboots)
Step 12:
Step 12:
Once complete it should auto boot into the new version, in this case with the UI changes
2. Unsolvable:
2. Unsolvable:
Problem #1: Inability to do the full cloud forensics
Problem #1: Inability to do the full cloud forensics
- The licence dongle did not contain the full licence for the UFED Cloud Analyzer, with the free version, we are able to only do extractions on a limited number of social media accounts, mainly Facebook, Twitter and Instagram, with the pre-requisite of it being public accounts
- This means that it is also not possible to import an account package of the suspect’s accounts (social media and otherwise) to perform forensics on the suspect that is being investigated on (The account package is usually found in the folder that the report is generated in).
3. Possible Challenge To Forensic In The Future: (For iOS)
3. Possible Challenge To Forensic In The Future: (For iOS)
Challenge:
Challenge:
- In recent beta releases of iOS 11, Apple added a feature that disables device's ability to connect to accessories over USB after the phone has been locked for a period of time. In May, the lockout kicked in after a week, however, Elcomsoft (which makes forensic tools that can unlock and access data from mobile devices) noted just a couple of days ago that the iOS 11.4.1 beta release shortened the time to just one hour, and early testers of the iOS 12 developer beta are seeing the same thing there.
- According to Elcomsoft, the most recent 11.4 beta beefed up the Restricted Mode even more, because once it kicks in, the device does not communicate or transfer data over USB at all. iTunes cannot see it and the device will only charge until it is unlocked with the owner's passcode.
- This would prove to be a challenge to future password cracking on phones since most of these techniques (By Cellebrite & Elcomsoft) requires brute forcing of the passwords.
- Sources:
Solution:
Solution:
- Researchers at ElcomSoft found a loophole to this Restricted Mode, which is to connect any USB accessory into the iPhone's Lightning port, with the pre-requisite that it has not entered Restricted Mode prior to the connecting of the USB accessory. This method resets the USB Restrictive Mode countdown timer.
- This USB accessory can also be an untrusted USB accessory and can be one that has never been paired to the iPhone before.
- One of the cheapest method is to use Apple's own lightning to USB 3 Camera Adapter which only costs $39 online. Though, other accessories like the $9 Lightning to 3.5mm adapter does not work.
- *NOTE: There is no technical workaround/bypass of the Restricted Mode once it is already engaged and past the 1 hour time frame.
- Sources:
Impacts:
Impacts:
- This would likely affect the seizing and transporting of iPhone devices, as after iOS 11.4.1, there may be a need for a compatible lightning accessory on top of isolating the device in a Faraday bag and connecting a battery pack.
- Prior to iOS 11.4.1, merely isolating the iPhone inside a Faraday bag and connecting a battery pack would be enough while seizing and transporting the device.
Google Sites
Report abuse