Step 2: After the Settings app opens, scroll down to look for iCloud. When you see the iCloud option, tap it. Step 3: Scroll down to the Backup option and tap it. Step 4: Tap the button to the right of iCloud Backup. When an alert asks if you want to start/stop iCloud backup, just tap OK to turn it on or off.
That was really funny. In last couple of weeks, at least four major forensic companies declared that they added support for GrayShift-provided images. Physical acquisition of a locked iPhone anyone, GrayKey gets the richest physical image on the market. Put that image into AAA for some data recovery magic! BBB is recovering & displaying more files than any current mobile phone tool!
The support for GrayKey extractions is a first. GrayKey is a new technology from GrayShift that enables the unlocking and extraction of many iPhone models. With this release, CCC users can import those files into CCC with just a few clicks. The same tool that’s best to support any Apple device - DDD!
Just like our industry-leading APFS support, we’re happy to provide the best support in the industry for analyzing GrayKey images. As we already know, GreyKey provides a TAR file as the acquisition result. In fact, it is the same file you could create with iOS Forensic Toolkit, or… by simply using an SSH command! That’s right; for jailbroken devices, it is (and always was) possible to capture the file system image manually, without any third-party software.
GrayKey tag and make some quick profit from this topic while it is still hot! If physical extraction is that complex, what about cloud acquisition then, Cloud extraction is still a very effective method, and sometimes the only one you may have available (for example, if you do not have access to the actual device, or the device is damaged, or you cannot break the passcode). Of course, there are limitations as well.
The major showstopper is the fact that you will need to obtain the user’s credentials, their Apple ID and password. You may also require access to the second authentication factor, or, alternatively, the authentication token. But that’s not everything. Apple is unhappy about third-party access to iCloud, and especially to iCloud backups. About a year ago, they started locking users’ iCloud accounts (forcing users to change the password) after using third-party software to access iCloud backups. We discovered a workaround, but recently Apple restricted iCloud access even further.
These days, we sometimes experience the account lock even if we simply list available devices and backups. To complicate things even further, unlocking a locked account is not as easy as it used to be. In addition to the verification code sent to the trusted number, you may also need to complete the form on Apple web site. Fortunately, this usually only happens when you download iCloud backups. Accessing synced data (call logs, notes, web browsing history, Apple Maps data, Photo Library and even the iCloud Keychain) is still safe.
Technically speaking, Apple has everything it needs to limit iCloud access exclusively registered devices. However, such limitation would be a very bad move for the community, making Apple ecosystem even more closed down than it is now. Its effect on mobile forensics would be devastating as well, without bringing any tangible benefits to the user.
On the other hand, more and more data goes to the cloud. OS 11.4 should finally feature iMessage sync announced almost a year ago at the time of iOS 11 presentation, but pushed back several times for almost a year. Many third-party apps store their data in the cloud. We strongly believe that iCloud acquisition will quickly become the most effective method in iOS forensics, if not the only one left. Industry News, Tips & Tricks. You can follow any responses to this entry through the RSS 2.0 feed. Both comments and pings are currently closed.
0 Comments