Daily Blog #632: Using Elcomsoft IOS Toolkit on an iPhone with IOS 12.1

Hello Reader,

            Kevin Stokes is the mobile forensics champion in our offices at G-C Partners. When we get a copy of the new Elcomsoft IOS toolkit it was Kevin who went to work to test it out and understand what it was capable of. Kevin was nice enough to write up a quick guide to walk you through the process of doing this yourself!

Elcomsoft 5.0 & rootlessJB by Kevin Stokes (02.25.2019)

This process was done on a device running iOS 12.1. 

It is part of Elcomsoft’s tested jailbreaks listed in their documentation for iOS Toolkit 5.0.

*NOTE:  As always, for a forensic acquisition, document your steps and interactions.

1. Using the Safari mobile browser…

(May work in other browsers? But Safari should exist on phone.)

2. Go to https://ignition.fun, get the app.

3. Select the packages icon (circled in Blue).

4. This will bring up the App categories available.

5. Select Jailbreaks (also circled in Blue).

6. Select the “rootlessJB” from Jake James (again, in blue).

7. “GET” the app (In Red!), to continue

8. Select “Install”, to download and install on the phone.

9. You will now have the “rootlessJB” app installed

10. But wait!  No need to select it yet.

11. We need to work on our trust issues…

12. Trust Issues

13. Go to Settings > General > Device Management

14. Select the Khodal Enterprise app

15. Select Trust Khodal Enterprise

16. Select “Trust” once more.

17. Once Trusted, the screen will look like the following (Allowing you to Delete the App, but don’t)

18. Jailbreak it!

19. Open the rootless JB app, make sure to turn off “iSuperUS” and “Tweaks” (slide left)

20. No need to add these for an acquisition.

21. Select “Jailbreak” (the button with be greyed out for a moment).

22. A message will appear at the bottom when it is successful.  (In testing, this took less than a minute each time)

23. iOS Toolkit Time!

24. Select “F” to perform a File System acquisition.

25. Give the tar file a name, default is “user.tar”

26. Provide the SSH password …  (Hint! It’s “alpine”)

27. Get another cup of coffee, while it downloads. 

Also Read:  Elcomsoft IOS Toolkit and IOS 12

Read More

Daily Blog #631: Elcomsoft IOS Toolkit and IOS 12

Hello Reader,
        If you haven't already heard Elcomsoft had updated their IOS Forensic Toolkit recently, you can check it out here: https://www.elcomsoft.com/eift.html. We got a license and tested it out and what we found is that:
A. It does not ship with any rootless jailbreaks
B. It does not automate the process of installing rootless jailbreaks
C. It does not do a physical image of the device

What it does do though is provide you a list of tested Jailbreaks (rooted and rootless) that you can install on an iOS device. Once the jailbreak is installed you can then use the Elcomsoft iOS Forensic Toolkit to decrypt the keycahin and most importantly get a full file system dump. We've tested this on an iPhone running IOS 12 and I can confirm that all the hidden and system directories we missed were included.

This includes not only FSEvents data but also the KnowledgeC databases that Sarah Edwards has been blogging about. We attached the same rootless jailbroken phone to Celebrite and it did not detect the presence of the jailbreak and so did not allow for a full filesystem dump.

While I'm sure this will be fixed in the never ending mobile forensics arm race in the near future its a point towards Elcomsoft this round.

Though I do have to wonder, if we could just dump a tar of the phones contents after applying the jailbreak ourselves without using Elcomsoft at all. This will be tomorrows testing along with a write up this week of our process for doing so.

Also Read: Using Elcomsoft IOS Toolkit on an iPhone with IOS 12.1

Read More