iPhone Forensics

Recovering the Media Partition

With the recovery toolkit installed and the iPhone sharing a network connection with your desktop, the media partition can finally be recovered. Depending on what level of integrity you’re looking to establish, there are many different ways to accomplish this. This section walks you through the different steps involved in recovering the media partition. Some processes are optional, and it will ultimately be up to you to determine which security options are important.

Note

Prior to performing a recovery, it’s a good idea to disable the iPhone’s locking mechanism. Click on the Preferences icon, then General. Change the Auto-Lock option to Never.

Command-Line Terminal

Much of the work involved from here on out will be performed on the command line, so it’s important to know how to invoke a command-line terminal window.

Mac OS X

Find the Terminal application by opening the Applications folder, and double-clicking on the Utilities folder. Double-click Terminal to open the application. Subsequent windows can be opened by selecting New Window from the Terminal menu.

Windows

Click on the Start menu, then highlight Programs, followed by Accessories. Click on the Command Prompt application. This will open a new window with what you may refer to as a “DOS prompt.”

Tools Needed

To recover the media partition, you’ll need two command-line tools on the desktop: dd and nc. The dd tool is a disk copy tool used to copy the raw drive image, while the nc tool (also known as