1

Cellebrite iOS Device Physical Extraction Manual

November 22, 2011

McSira BVBA / SPRL

2

Table of Contents

Introduction…………………………………………………………………………………………………………………………………………………4

Before you begin ............................................................................................................................................ 5

Performing an Extraction……………………………………………………………………………………………………………………………..6

Step 1: Launch UFED Physical Analyzer ......................................................................................................... 6

Step 2: Open iOS Device Physical Extraction ................................................................................................. 7

Step 3: Turn off the device ............................................................................................................................ 9

Step 4: Connect the device to your computer in Recovery Mode ................................................................ 9

Step 5: Setting the Device to DFU Mode ..................................................................................................... 11

Step 6: Extract Data ..................................................................................................................................... 12

Step 7: Wait ................................................................................................................................................. 13

Step 8: Turn off the device .......................................................................................................................... 14

Instructions for Encrypted Devices……………………………………………………………………………………………………………..15

Extracting from a device with a simple passcode ........................................................................................ 16

Extracting from a device with a complex passcode ..................................................................................... 18

McSira BVBA / SPRL

3

McSira BVBA / SPRL

4

Introduction

This manual explains how to extract data from an iPhone, iPod or iPad using UFED Physical Analyzer.

UFED Physical Analyzer allows you to extract, decode and analyze the following devices running iOS Version 3.0 or higher:

iPhone (original)

iPhone 3G

iPhone 3GS

iPhone 4 GSM

iPhone 4 CDMA

iPad 1

iPod Touch (3rd generation)

iPod Touch (4th generation)

McSira BVBA / SPRL

5

Before you begin

Before you begin you will need:

UFED Physical Analyzer installed on a PC with Windows XP / Vista / 7 Operating Systems (iPhone/iPod/iPad physical extraction will not work in Virtual Machine environments).

UFED Cable Number 110.

An Internet connection for the first run of iOS Physical to download the necessary forensic utilities. You can also download the utilities using a different computer and copy them manually to the computer running iOS Physical.

McSira BVBA / SPRL

6

Performing an Extraction

The following steps will guide you through the extraction process.

Step 1: Launch UFED Physical Analyzer

1. Launch UFED Physical Analyzer by clicking the application icon or program shortcut.

The default location of UFED Physical Analyzer is:

C:\Program Files\Cellebrite Mobile Synchronization\UFED Physical Analyzer

McSira BVBA / SPRL

7

Step 2: Open iOS Device Physical Extraction

1. Open the Tools menu and select iOS Device Physical Extraction. This will launch UFED iOS Physical.

The first run after installation

On the first run of UFED iOS Physical you will be asked to download the iOS Device Support Package. This contains the newest utilities that enable UFED iOS Physical to work with a variety of devices and iOS versions. The download may take a while, depending on your Internet connection.

McSira BVBA / SPRL

8

If you don't have an Internet connection

If your computer is not connected to the Internet, download the support package on a different computer and manually copy it to your computer.

2. Click this link1 to download the latest support package.

3. Copy the file to the computer running iOS Physical.

4. On the welcome screen in iOS Physical, click on Install from file and locate the file on your computer.

1 http://www.cellebrite.com/ios

McSira BVBA / SPRL

9

Step 3: Turn off the device

1. Follow the steps on the screen to turn the device off.

Step 4: Connect the device to your computer in Recovery Mode

1. Follow the steps on the screen to connect the device in Recovery Mode.

Use Cellebrite Cable #110 or the Apple cable supplied with the device.

McSira BVBA / SPRL

10

2. After connecting the device in Recovery Mode, UFED iOS Physical will display some device information, such as serial number, hardware version, iOS version and more.

3. You can copy that information to the clipboard by clicking the Copy link.

Note: When a range of versions is displayed, the version of the device may be any version within the displayed range. For example, if the version shows "4.0-4.0.2", the actual version can be 4.0, 4.0.1 or 4.0.2.

McSira BVBA / SPRL

11

Step 5: Setting the Device to DFU Mode

1. Click Next on the screen with the device information.

2. Follow the instructions on the screen to set the device to DFU (Device Firmware Upgrade) mode.

UFED iOS Physical will not affect the device firmware or user data.

Note: This step requires precise timing. If the device accidentally turns on, disconnect it from the cable, turn it off and start again.

3. When the device enters DFU mode, UFED iOS Physical will upload the forensics program required to extract data from the device.

McSira BVBA / SPRL

12

Step 6: Extract Data

Now the device is ready for extraction.

1. Choose the desired extraction method (Physical or File System).

2. Choose the location to which you wish to save the extraction. You can save it on your computer or on a removable storage device.

3. Choose a partition for extraction.

In a physical extraction you can choose between the Data partition, the System partition or both.

In a file system extraction you can choose between the Data partition or both.

4. Click Next.

If the device is locked by a passcode, see "Instructions for encrypted devices" (Page 15)

McSira BVBA / SPRL

13

Step 7: Wait

1. Wait until the extraction completes.

The extraction duration varies depending on the extraction method, the device model, amount of data on the device, your computer and other parameters.

2. When the extraction is complete you will have four options:

2.1. Open in UFED Physical Analyzer – This will load the extraction file in UFED Physical Analyzer.

2.2. Open file location – Will open the folder that contains the extraction files.

2.3. Turn off the device and exit – Turns off the device and sets it back to normal mode.

2.4. Back to extraction options – Returns to the extraction methods screen.

McSira BVBA / SPRL

14

Step 8: Turn off the device

When you're done, it's recommended that you turn off the device and set it back to normal mode.

McSira BVBA / SPRL

15

Instructions for Encrypted Devices

UFED iOS Physical can extract data from encrypted devices. The amount of data that can be extracted depends on the type of passcode with which the device is locked.

There are two kinds of passcodes:

Simple passcode – 4 digits from 0 to 9 (e.g. 1234, 8787, 2580, etc.)

Complex passcode – any combination of numbers, letters and symbols (e.g. 93qP@Mv, iLoVeYoU, etc.)

The decryption process happens in UFED Physical Analyzer and not during the extraction in iOS Physical. Most data can be decrypted without knowing the passcode, such as contacts, messages, photos, some emails and more. However, to decrypt some of the saved passwords and emails you will need to know the device passcode.

iOS Physical will automatically recover the passcode for you if it's locked with a simple passcode. If the device is locked with a complex passcode you can choose to manually try as many passcodes as you like or continue the extraction without being able to decrypt some of the saved passwords and emails.

If the device isn't locked with a passcode, all data will be extractable – even if the device is encrypted.

McSira BVBA / SPRL

16

Extracting from a device with a simple passcode

Follow Steps 1 through 5, as detailed in the previous chapter.

When the device is ready for extraction you will have the usual Physical Extraction and File System Extraction options and an additional Passcode Recovery option.

The option Passcode recovery will reveal the device passcode so you can unlock and use the device or to accelerate the extraction process.

To extract and recover the passcode in a single process, choose Physical Extraction or File System Extraction. In this example we will demonstrate the steps with a physical extraction, but they are the same for a file system extraction.

McSira BVBA / SPRL

17

1. Click on Physical Extraction.

2. In the next screen, choose the partition you wish to extract and the location at which you want to save the extraction. Click Next If you don't know the passcode, click on Recover the passcode for me. This will recover the passcode prior to the extraction and will take more time.

3. If you do know the passcode, enter it in the text box below. You will see a check mark if you entered the correct passcode. Then click Continue >.

4. The extraction will begin.

McSira BVBA / SPRL

18

Extracting from a device with a complex passcode

Follow Steps 1 through 5, as detailed in the previous chapter.

When the device is ready for extraction you will have the usual Physical Extraction and File System Extraction options and an additional Test passcodes option.

The option Test passcodes allows you to type in as many passcodes as you like and checks them in real time. iOS Physical cannot recover a complex passcode automatically.

As mentioned before, most data will be decrypted in UFED Physical Analyzer, but some of the saved passwords and email files will not be decrypted. To extract data, choose Physical Extraction or File System Extraction.

In this example we will demonstrate the steps with a physical extraction, but they are the same for a file system extraction.

McSira BVBA / SPRL

19

1. Click on Physical Extraction.

2. In the next screen, choose the partition you wish to extract and the location at which you want to save the extraction. Click Next.

3. iOS Physical can't recover a complex passcode automatically, so you either have to enter it manually or be aware that some data will not be decrypted in UFED Physical Analyzer.

4. Use the text box to test as many passcodes as you like without locking the device. If you enter the correct passcode you will see a check mark and a Continue > button will appear. Click it.

5. If you don't know the passcode, click Continue without passcode >.

6. The extraction will then begin.

McSira BVBA / SPRL