iPhone Forensics. Recovering Evidence, Personal Data, and Corporate Assets - Helion
ebook
Autor: Jonathan ZdziarskiISBN: 978-05-965-5503-0
stron: 140, Format: ebook
Data wydania: 2008-09-12
Księgarnia: Helion
Cena książki: 118,15 zł (poprzednio: 137,38 zł)
Oszczędzasz: 14% (-19,23 zł)
Tagi: iPhone
"This book is a must for anyone attempting to examine the iPhone. The level of forensic detail is excellent. If only all guides to forensics were written with this clarity!"-Andrew Sheldon, Director of Evidence Talks, computer forensics experts
With iPhone use increasing in business networks, IT and security professionals face a serious challenge: these devices store an enormous amount of information. If your staff conducts business with an iPhone, you need to know how to recover, analyze, and securely destroy sensitive data. iPhone Forensics supplies the knowledge necessary to conduct complete and highly specialized forensic analysis of the iPhone, iPhone 3G, and iPod Touch. This book helps you:
- Determine what type of data is stored on the device
- Break v1.x and v2.x passcode-protected iPhones to gain access to the device
- Build a custom recovery toolkit for the iPhone
- Interrupt iPhone 3G's "secure wipe" process
- Conduct data recovery of a v1.x and v2.x iPhone user disk partition, and preserve and recover the entire raw user disk partition
- Recover deleted voicemail, images, email, and other personal data, using data carving techniques
- Recover geotagged metadata from camera photos
- Discover Google map lookups, typing cache, and other data stored on the live file system
- Extract contact information from the iPhone's database
- Use different recovery strategies based on case needs
And more. iPhone Forensics includes techniques used by more than 200 law enforcement agencies worldwide, and is a must-have for any corporate compliance and disaster recovery plan.
Osoby które kupowały "iPhone Forensics. Recovering Evidence, Personal Data, and Corporate Assets", wybierały także:
- Zen Steve'a Jobsa 29,67 zł, (8,90 zł -70%)
- Programowanie aplikacji mobilnych dla iOS z wykorzystaniem Xcode, Swift 3.0 i iOS 10 SDK. Kurs video. Poziom pierwszy 99,00 zł, (44,55 zł -55%)
- Flutter i Dart 2 dla początkujących. Przewodnik dla twórców aplikacji mobilnych 89,00 zł, (44,50 zł -50%)
- Dostosuj się lub giń. Jak odnieść sukces w branży aplikacji mobilnych 44,90 zł, (22,45 zł -50%)
- Podstawy języka Swift. Programowanie aplikacji dla platformy iOS 49,00 zł, (24,50 zł -50%)
Spis treści
iPhone Forensics. Recovering Evidence, Personal Data, and Corporate Assets eBook -- spis treści
- iPhone Forensics
- Dedication
- A Note Regarding Supplemental Files
- Foreword
- Preface
- Audience of This Book
- Acknowledgments
- Organization of the Material
- Conventions Used in This Book
- Using Code Examples
- Legal Disclaimer
- Safari Books Online
- Wed Like to Hear from You
- 1. Introduction to Computer Forensics
- Making Your Search Legal
- Rules of Evidence
- Good Forensic Practices
- Preserve the Evidence
- Document the Evidence
- Document All Changes
- Establish an Investigation Checklist
- Be Detailed
- Technical Processes
- 2. Understanding the iPhone
- Whats Stored
- Equipment Youll Need
- Determining the Firmware Version
- Disk Layout
- Communication
- Upgrading the iPhone Firmware
- Restore Mode and Integrity of Evidence
- Cross-Contamination and Syncing
- The Takeaway
- 3. Accessing the iPhone
- Installing the Recovery Toolkit (Firmware v1.0.21.1.4)
- Step 1: Download and Install iLiberty+
- Mac OS X (iLiberty+ v1.6)
- Windows (iLiberty+ v1.3.0.113)
- Step 2: Dock the iPhone and Launch iTunes
- Step 3: Launch iLiberty+ and Verify Connectivity
- Booting out of recovery mode
- Mac OS X
- Windows
- Step 4: Activate the Forensic Toolkit Payload
- Mac OS X
- Windows
- Step 5: Install the Payload
- Mac OS X
- Windows
- Its stuck!
- What to watch for
- Step 1: Download and Install iLiberty+
- Circumventing Passcode Protection (Firmware v1.0.21.1.4)
- Automated Bypass
- Manual Bypass
- Step 1: Prepare a custom RAM disk
- Step 2: Enter recovery mode
- Step 3: Upload and boot the custom bypass RAM disk
- Installing the Recovery Toolkit (Firmware v2.x)
- Step 1: Install and Run Pwnage v2.x
- Step 2: Use Xpwn to Customize the Stage 1 Firmware
- Step 3: Use Xpwn to Customize the Stage 2 Firmware
- Step 4: Install the Staged Firmware Bundles
- Removing the Forensic Recovery Toolkit
- Installing the Recovery Toolkit (Firmware v1.0.21.1.4)
- 4. Forensic Recovery
- Configuring Wi-Fi and SSH
- Connecting to an Access Point
- Creating an Ad-Hoc Network
- Mac OS X
- Windows
- SSH to the iPhone
- Recovering the Media Partition
- Command-Line Terminal
- Mac OS X
- Windows
- Tools Needed
- MD5 Digests
- Unencrypted Recovery
- Mac OS X
- Windows
- Sending the data
- Encrypted Recovery of the Media Partition
- Making Commercial Tools Compatible
- Command-Line Terminal
- Data Carving Using Foremost/Scalpel
- Configuration for iPhone Recovery
- Dynamic dictionaries
- Voicemail messages
- Property lists
- SQLite databases
- Web pages
- Other files
- PGP blocks
- Images
- Building Rules
- Scanning with Foremost/Scalpel
- Configuration for iPhone Recovery
- Validating Images with ImageMagick
- Strings Dump
- Extracting Strings
- Mac OS X
- Windows
- Extracting Strings
- The Takeaway
- Configuring Wi-Fi and SSH
- 5. Electronic Discovery
- Converting Timestamps
- Mounting the Disk Image
- Disk Analysis Software
- Mac OS X and native HFS support
- Windows and HFSExplorer
- Disk Analysis Software
- Graphical File Navigation
- Images of Interest
- Extracting Image Geotags with Exifprobe
- SQLite Databases
- Connecting to a Database
- SQLite Built-in Commands
- Issuing SQL Queries
- Important Database Files
- Address Book Contacts
- Putting it all together
- Address Book Images
- Google Maps Data
- Calendar Events
- Call History
- Email Database
- Notes
- SMS Messages
- Voicemail
- Address Book Contacts
- Property Lists
- Binary Property Lists
- Mac OS X
- Windows
- Important Property List Files
- Binary Property Lists
- Other Important Files
- 6. Desktop Trace
- Proving Trusted Pairing Relationships
- Pairing Records
- Serial Number Records
- Mac OS X
- Windows XP
- Windows Vista
- Device Backups
- Activation Records
- Proving Trusted Pairing Relationships
- 7. Case Help
- Employee Suspected of Inappropriate Communication
- Live Filesystem
- Data Carving
- Strings Dumps
- Employee Destroyed Important Data
- Seized iPhone: Whose Is It and Where Is He?
- Who?
- What?
- When and Where?
- How Can I Be Sure?
- Employee Suspected of Inappropriate Communication
- A. Disclosures and Source Code
- Power-On Device Modifications (Disclosure)
- Installation Record (Disclosure)
- Technical Procedure
- Unsigned RAM Disks
- Source Code Examples
- Index
- About the Author
- Colophon
- Copyright