Acquisition of jailbroken devices
We recommend treating all iOS devices the same. This means, do not try to handle jailbroken devices one manner and non-jailbroken in another manner. Essentially, try everything possible to gain access to that device. First, try a physical acquisition. If this method fails, attempt a file system acquisition, followed by a logical acquisition. If the device is locked and the passcode is required to acquire the device, attempt to crack it. The state of the iOS device should not keep you from trying your hardest to get a full physical image. For devices that are truly jailbroken, you will see how much easier this makes your life when attempting to acquire data.
There are several methods on both Mac and Windows platforms ...
Get Practical Mobile Forensics - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
