killchain-compendium/forensics/ios.md

33 lines
681 B
Markdown
Raw Normal View History

2021-09-02 01:19:53 +02:00
# iOS Devices
## Trust Certificates
* Exchanged between 'Trusted' devices and the charging iOS device.
* iTunes access to the iOS device has elevated permissions using the cert.
* Keychain may be extracted through iTunes.
## Interesting Files
* `ResetCounter.plist`, hard Reset diagnostic counter
* `com.apple.preferences.datetime.plist`
* DB tables
* Atendee
* Task
* Event
* Mail
* Safari
* Cookies
* Pictures
* Addressbook
* SMS
* Voicemail
* WiFi Keys
## Backups
Encrypted and unencrypted backups can be chosen in the iTunes menu.
## Tools
* [iFunbox](https://www.i-funbox.com/en/page-about-us.html)
* [O.MG cable](https://shop.hak5.org/products/o-mg-cable)