iPhone Forensics

Mounting the Disk Image

When you transmit the disk image from an iPhone, you’re getting a complete HFS/X filesystem (or HFS+ if you converted it). As a filesystem, this can be mounted on a Mac or Windows machine with a little work.

Note

Be sure you are working with a copy of the disk image by now, and not the original. The section Unencrypted Recovery in Chapter 4 explains why.

Disk Analysis Software

Before the disk image can be mounted, you may need to perform certain tasks or install software so that your computer can properly read the disk image.

Mac OS X and native HFS support

Mac OS X supports the HFS+ filesystem natively, so it is already able to read the disk image without any additional software. You’ll need to rename the file you downloaded, however, to have a .dmg extension. You can then directly mount it from the finder:

$ mv rdisk0s2 rdisk0s2.dmg
$ hdid –readonly rdisk0s2.dmg

Once mounted, the volume should appear on the desktop and on the Finder’s sidebar, listed under Devices. It can then be browsed to with the Finder or examined using Unix tools from a terminal window. The volume will be mounted in /Volumes.

Windows and HFSExplorer

Windows doesn’t understand the HFS/X disk image format by default, so you’ll need a tool that’s capable of reading the format. HFSExplorer is an application that can extract files from an HFS+ volume and load raw image files such as the one you dumped from the iPhone. It is published under the GNU General Public License (GPL) and is freely available ...