iPhone Forensics

Serial Number Records

In addition to pairing records, a manifest is written to the desktop machine to keep track of the names and serial numbers of devices paired with it, allowing the examiner to verify that a desktop not only knows how to sync with a particular iPhone, but also knows the iPhone’s hardware serial number. The manifest file can be used to match the serial number recorded in the file with the serial number of the mobile device.

Note

The serial number of the mobile device can be obtained by tapping the Settings button on the device and then selecting General About.

Mac OS X

A binary property list with a filename beginning with com.apple.iTunes may be found in the directory /Users/username/Library/Preferences/ByHost. Each host paired with the device will be assigned a separate file in this directory. The property list stores information about the device in a binary format, but you can use the strings tool described in earlier chapters to dump the ASCII data encapsulated within the binary information and search for the mobile device’s serial number:

$ strings com.apple.iTunes.001b619668af.plist

Scan through the output of this command and visually search for the device’s serial number, or use the grep command to scan for a specific string.

Windows XP

A match to the serial number can be found in a file named C:\Documents and Settings\username\Local Settings\Application Data\Apple Computer\iTunes\iPodDevices.xml.

Windows Vista

A match to the serial number can be found in a file named ...