JDiamond wrote:
1. What software has anyone used to successfully extract data from an
iPhone 5?
2. Does the software allow for extraction of the slack space or
unallocated space to try and recover the deleted video?
1. Yes, there are tools to extract a logical file system from an iphone 5, i know the cellebrite ufed will do it.
2. no you will not get a physical dump of an iphone4s+, ipad2+ by any tools. even then, according to apple due to the basic file encryption scheme that they use, every file is encrypted on the device. When a file is deleted the keys are deleted, and in some instances secure erased. Basically it's currently (and I dont know if it ever will be) possible to recover deleted files from a newer ios device.
You may have luck pulling ithmb files but that's all i can think of.
without testing, i think the iphone takes a screen shot when a user does fast application switching. that might show up somewhere but i cant recall off the top of my head where to look.
↧