One day the 'Armando Buzzanca friend calls me because he has to retrieve a voice note (audio file) of his friend, who has erased error from your iPhone.
I see difficult, because even with the world of Apple do not have much to do, then proceed by trial and error, not being an activity of simple but forensic data recovery.
I notice that the iPhone does not give access to all data for this reason it needs to be jailbrekkato , which is a kind of release that will also allow the installation of app Call Cydia through which you can download many other useful applications to run on the iPhone immgine all files.
Phone friend Nicola Troccoli , I recommend you connect with the iPhone Safari go to: http://www.jailbreakme.com , but this jailbreak does not work on firmware 4.01, then I open Facebook and ask for help, comments and chat between beak Antonio Di Giorgio that suggests to me Limera1n another jailbreak, this time it works (I also suggest GreenPois0n )! Meanwhile, flake the comments and advice of other friends.
rebooted the iPhone, Cydia is, after tinkered a bit, I can download and install Mobile Terminal and OpenSSH at this point enters dance in Linux!
Connect iPhone to your WiFi network logged into the router and then see what IP address has taken the Iphone:
192.168.1.154
Launch CAINE Live on a machine and install the SSH server
sudo apt-get install ssh
then sudo / etc / init.d / ssh start to start the SSH server. (For more insight book Denis )
At this point Caine, we can mount a NTFS disk write and launch the terminal window and type: sudo ssh
192.168.1.154
seems the iPhone terminal prompt, enter the credentials:
user: root
password: alpine
(the iPhone is the default) then type
dd if = / dev/disk0 ask for the password of Caine (as they must connect to the SSH server Caine) and then type " caine." The dd
side and begins to write 16GB of image files in the chosen directory.
ANALYSIS
Now we have to find the file of the voice note, I call again, Nicola and I do send a voice note, the file is
prova.m4a prova.m4a I open the editor hex and take out the header:
00 00 00 66 74 1C 00 00 2C and footer
Creo file foremost.conf
M4a 8000000 y \\ x00 \\ x00 \\ x00 \\ x1C \\ x66 \\ X74 \\ x00 \\ x00 \\ x2Claunch Caine
foremost foremost.conf-i-c-o iphone.dd. / Carv
carving on the side ... and finally ... do not derive from a spider hole!
Now I do not know if it is because of the particular file type, or for other reasons, but trying to look for JPG, AIFF, MOV carving has been successful .... then everything works, will investigate further to understand how to extract or mount the kind of image file. Everything was done manually with free tools and certainly if we had used a UFED
, maybe we had fewer problems;)The teamwork has been fundamental to the support network and skills that are activated and started from scratch .... I am the same feeling when I developed Caine, chat, email, phone, seems to be in a mega REMOTE team .... and everything is faster and you learn.
After all, those who invented distributed computing had seen better ... just so many brains to work in parallel on a problem ... and without needing to be in the same room ...! continue to confront and to exchange knowledge ... we grow! Indeed
trust in the comments to this article to suggest how to act and continue to improve some steps in this procedure;)
Now some notes:
http://www.ispazio.net/guide jailbreak-iphone-3g-
(various JailBreak)
as PuTTY SSH client
FreeSSHd
0 comments:
Post a Comment