iPhone Forensics

Errata for iPhone Forensics

Submit your own errata for this product.

The errata list is a list of errors and their corrections that were found after the product was released. If the error was corrected in a later version or reprint the date of the correction will be displayed in the column titled "Date Corrected".

The following errata were submitted by our customers and approved as valid errors by the author or editor.

Color key: Serious technical mistake Minor technical mistake Language or formatting error Typo Question Note Update

Version Location Description Submitted By Date submitted Date corrected
Page 3
Chapter 3

Apple has recently changed their drivers in Mac OS X 10.5.6 and on new model MacBook and MacBook Pro notebooks, causing the machine to fail to recognize the iPhone in DFU (Device Failsafe Utility) mode. The workaround for this is to connect the iPhone to the desktop machine using a USB hub. It may be necessary to do this to perform the steps in Chapter 3.

Jonathan Zdziarski
Jonathan Zdziarski
Jan 01, 2009 
Page 28
Script Example

On page 28, the example script to remove the passcode was erroneously printed with the following line:

nvram auto-boot=true.nvram -d boot-args

The period was mistakenly inserted as carriage return is a non-printable character in hex editors. The period should actually be a newline, resulting in two scripting lines:

nvram auto-boot=true
nvram -d boot-args

Jonathan Zdziarski
Jonathan Zdziarski
Sep 19, 2008  Aug 29, 2014
Page 37
Step 3

On page 37, step 3 instructs the reader to copy the contents of the Pwned firmware bundle into the stage2 folder, but assumes the reader already knows how to do this from previous examples. The proper command to extract the contents of the archive should be issued immediately after the command "mkdir stage2", as shown below:

# mkdir stage2
# unzip -d stage2 ~/Desktop/iPhone1,2_2.0_5A347_Custom_Restore.ipsw

Jonathan Zdziarski
Jonathan Zdziarski
Oct 10, 2008  Aug 29, 2014
Page 40
Second Example

On page 40, the reader is given the command to re-zip the modified firmware files back into an IPSW bundle using the zip command. This example should mirror the one given on page 37 for building the first stage bundle, but is missing the trailing asterisk. The command should instead read:

zip -r ~/stage2.ipsw .fseventsd *

Jonathan Zdziarski
Jonathan Zdziarski
Sep 17, 2008  Aug 29, 2014
Page 44
Step 3

A list of available wireless networks will appear in the section labeled "Choose a Network Tap" on the network that your desktop is presently connected to.

should read

A list of available wireless networks will appear in the section labeled "Choose a Network." Tap on the network that your desktop is presently connected to.

Anonymous  Sep 27, 2008  Aug 29, 2014
Page 62
String commands

On my machine (Mac Mini) when I tried to make the string dump it threw me an error: "strings: can't map file: filename (Cannot allocate memory)" Could be some wonkiness on how strings works on OS X, I'm not sure.

Perhaps the command should be changed to "cat rdisk0s2 | strings > filename"? That worked fine for me.

Note from the Author or Editor:
This is a reasonable workaround in the event that you run into this problem. I was not able to reproduce it on my system, though. Maybe I have more memory.

Anonymous  Sep 16, 2008