Comments on: ElcomSoft Breaks iPhone Encryption, Offers Forensic Access to File System Dumps http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/ «...This blog is about <a href="/?s=password+recovery">cracking passwords</a>, <a href="/?s=forensic">forensics solutions</a>,<br><a href="/?s=security">computer and network security</a>, <a href="/?s=system+recovery">system recovery</a> and other things...» Wed, 19 Jun 2013 10:37:47 +0000 hourly 1 http://wordpress.org/?v=3.5.1 By: Matt http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-30942 Matt Mon, 26 Nov 2012 06:30:29 +0000 http://blog.crackpassword.com/?p=1636#comment-30942 personal loans without credit check

]]> By: John http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-30931 John Wed, 19 Sep 2012 08:52:34 +0000 http://blog.crackpassword.com/?p=1636#comment-30931 IF you can physically open the device without disturbing the memory contents and then remove the memory chips assuming they are non volatile, they can be reverse engineered in a lab replete with a FIB, Hiring FIB time is low cost, quick and a sure way to extract data. Surer than the software, and then a copy of the data can be inspected non destructively, and even if software traps are triggered just load another copy.

]]> By: Andrey Belenko http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-28706 Andrey Belenko Thu, 05 Apr 2012 09:23:21 +0000 http://blog.crackpassword.com/?p=1636#comment-28706 Jailbreak is typically bad for security. With iOS 5 you still do not need to know the passcode to get most of the information from the device.

]]> By: IndiePhoenix http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-28703 IndiePhoenix Wed, 04 Apr 2012 21:09:09 +0000 http://blog.crackpassword.com/?p=1636#comment-28703 Hello,

Firstly, congratulations for your great work!

I’d like to know if a jailbreak affects in any way the security of an iPhone. And how is the new version of 5.1 in terms of security? Can you still find many things about an user even if you didn’t crack his passkey?

Thank you!

]]> By: Andrey Belenko http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-28636 Andrey Belenko Sat, 31 Mar 2012 06:53:18 +0000 http://blog.crackpassword.com/?p=1636#comment-28636 We have never evaluated such scenario, although my understanding is that (on iOS 4 and iPhone 3GS and newer) Flash contents are encrypted and decryption would require access to unique per-device encryption key which is probably embedded in application processor.

]]> By: iOSFlash http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-28535 iOSFlash Tue, 27 Mar 2012 18:56:11 +0000 http://blog.crackpassword.com/?p=1636#comment-28535 I was hoping you would be able to shed some light as to the potential for data accessibility on an iPhone assuming the following conditions:

iPhone (model X) loaded with iOS 3.x or higher is physically disassembled
MLB is physically damaged beyond repair (cut in half)
All chips, except the Flash, are removed and/or damaged beyond repair

Assuming the Flash chip is removed from the attached MLB without damage, what current possibilities exist to still recover usable data?

This may seem like a weird question to ask, but our goal is to ensure the data on the Flash chip is unrecoverable.

]]> By: Andrey Belenko http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-28044 Andrey Belenko Wed, 07 Mar 2012 09:54:19 +0000 http://blog.crackpassword.com/?p=1636#comment-28044 Hello,

You can of course transfer iTunes backup from Mac to the PC.

On Mac iTunes stores backups in ~/Library/Application Support/MobileSync/Backup/. Navigate to this folder (Shift-Command-G in Finder), locate required backup and copy Manifest.plist file from the backup directory to the PC. THis is the only file required to run password recovery, so you do to need to transfer whole backup (which may be quite big).

Hope this helps.

]]> By: Adrienne Downing http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-27826 Adrienne Downing Mon, 27 Feb 2012 02:05:01 +0000 http://blog.crackpassword.com/?p=1636#comment-27826 My iPhone backup (3GS running 4.3) was accidentally encrypted by an Apple store employee and then the phone wiped when upgrading to 5.0, leaving me with a lot of unbacked up information in my notes and txts. I read that Elcomsoft might be able to help me with this, but the backup is in iTunes on my MacBook Pro, not a PC (which it says the software is designed to be used with). Is there a way to use the software to break the backup code (such as transferring the backup file to a PC and using it on there)? I have a lot of business information I need in this backup and any information you could provide would be appreciated.

Thank you.

]]> By: PD http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-27675 PD Sun, 19 Feb 2012 11:06:44 +0000 http://blog.crackpassword.com/?p=1636#comment-27675 Hi,
Interesting blog post! I have a question about the keychain security on iOS 4.x:

Keychain entries of a 3rd party app are protected according their ‘protection class’. For example, the class ‘kSecAttrAccessibleWhenUnlocked’ means that the entry is only accessible when the device is unlocked. Does the OS automatically decrypt all keychain entries with that protection class as soon as the device gets unlocked?
If yes, this would mean that on a jailbroken device, a malicious application could read ALL keychain entries because they’re accessible when the device is unlocked and because of the jailbreak, sandbox does not prevent anymore that keychain entries can only be accessed by the app that they belong to.

Am I right with this assumption?

Thanks in advance.

]]> By: Lou Huerta http://blog.crackpassword.com/2011/05/elcomsoft-breaks-iphone-encryption-offers-forensic-access-to-file-system-dumps/comment-page-1/#comment-27398 Lou Huerta Sat, 11 Feb 2012 05:05:15 +0000 http://blog.crackpassword.com/?p=1636#comment-27398 I forgot my itunes password on my iphone and need to break it so that I can get into my info.

]]>