The Tech Herald

New forensics kit offers near-instant access to iOS 5 data

by Steve Ragan - Nov 1 2011, 18:10

ElcomSoft has released an update to their iOS Forensics kit, which touts a faster recovery time for protected system dumps and other tasks. The update increases ElcomSoft’s abilities to crack and extract data from iOS version 3.x, 4.x, and 5, on any Apple device.

“There was no break-through in the iOS security model”, says Andrey Belenko, ElcomSoft leading developer.

“The architectural changes are more of an evolution of the existing model. However, we highly welcome these changes, as they present better security to the end user. In particular, the number of keychain items that can be decrypted without the passkey is now less than it used to be. Device passcode is one of the hallmarks of Apple’s security model, and they are expanding the use of it to cover more data than ever before.”

Apple did make one major change in iOS 5 however, by replacing the keychain encryption algorithm entirely, and making Escrow Keybagging useless by protecting escrow keys with the device passcode.

This means that before anything can be done, ElcomSoft will need to brute force the passcode from the device. After that, full data recovery and analysis from the keychain is only a matter of time.

The keychain contains tons of information that is highly valuable to investigators, including stored logins and passwords to various websites, Wi-Fi hotspots, email accounts, and applications.

But what of the other data? Apple’s iOS accumulates huge amounts of information.

Besides the obvious pieces such as pictures, email and SMS messages, Apple’s devices store advanced usage information such as historical geolocation data, viewed Google maps and routes, browsing history, call logs, and nearly everything typed on the iPhone.

Most of this data is stored in the backups produced by iTunes, but was nearly impossible to get at in some cases.

“I love challenges”, says Dmitry Sklyarov, ElcomSoft’s leading cryptanalysis specialist.

“The new system release presented a perfect case. When we just started, we didn’t even know if we have a chance to break it. There are all-new encryption algorithms, changed keychain protection, new data structures… the list goes on and on. We did most of it before at the time of iOS 4 release, but the new system presented some unexpected challenges.”

In the new release, ElcomSoft says they can recover all of the encrypted data stored in the backups in about 20 minutes on a 16GB iPhone, or 40 minutes for the 32GB version.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Miami Formula E Tickets On Sale Now

Tickets for the first US race in the Formula E calendar — Miami — are on sale now.The ePrix&...

Our Most Popular Car Games Of 2014

It’s that time of year when we take stock of where we’re at and button down the hatches over...

Monster Truck World Speed Record Broken By The Raminator

The monster truck speed record has been broken by road-going goliath The Raminator.The truck...

Car Games Update – December 2014

Our car games section is constantly growing and becoming more popular by the day. Over the p...

The Mind-blowing 2015 BMW 6 Series (PICTURES)

Here’s a great selection of pictures of the new 2015 BMW 6 Series to salivate over. The new ...