Advanced Logical Extraction with iOS Forensic Toolkit 8: Cheat Sheet

1. Connect the iPhone to the computer’s USB port.
2. Once the iPhone is connected to the computer, you will be prompted to establish trust between the device and the computer. On the device, confirm the pairing prompt and enter the screen lock passcode. If the device was not automatically paired, you will need to manually pair the device to the computer by running the following command: 

3. ./EIFT_cmd normal pair

4. On the phone, confirm the “Trust this computer?” prompt.
   
   
5. On the phone, you may be prompted for a passcode if the device is running a recent version of iOS. Enter the screen lock passcode to confirm pairing.
6. Extract information about the device: 

7. ./EIFT_cmd info

8. Check if a backup password is set: 

9. ./EIFT_cmd normal backuppwcheck

10. If you are using an external pairing record file, pass it in the command line. Note: if this is the case, you will have to use the -r switch along with the path to the pairing record for all subsequent commands:
    
    

11. ./EIFT_cmd normal backuppwcheck -r record.plist

12. Check the output, looking for “Backup password” status:
    
    

13. Started logging Thread!
    Got device:
    Mode: [normal]
    BuildVersion: 16H50 
    DeviceName: iPhone 
    HardwareModel: N53AP 
    Paired: YES 
    PasswordProtected: NO
    ProductName: iPhone OS 
    ProductType: iPhone6,2 
    ProductVersion: 5.4
    SerialNumber:  udid: 
    Loading custom record from=record.plist 
    Checking backup password...
    Backup password is DISABLED 
    Done

14. If the backup password is enabled, make a password-protected backup nevertheless. After that, consider resetting the backup password with “Reset All Settings” (not to be confused with “Erase content and settings”, which factory-resets the device). To reset the backup password, follow Apple instructions: “On the iPhone, go to [Settings] | [General] | [Reset]. Press [Reset All Settings]; Follow the steps (you will be prompted for device passcode).”
15. (optional step) If the backup password is empty, you may manually set a known temporary password such as ‘123’. If you don’t, iOS Forensic Toolkit will automatically set a temporary password ‘123’ before the extraction, and remove it afterwards. Either way, the device will prompt for a screen lock passcode. Make sure to enter one quickly as the prompt is only displayed for a limited time. 

16. ./EIFT_cmd normal backuppwset -p "123"

17. Make a backup (the last parameter specifies using the current folder; you may provide a different path instead of “./”)
    Note: if the backup password is empty, iOS Forensic Toolkit will automatically attempt to set a temporary backup password of ‘123’. During the process, the device will prompt for a screen lock passcode. Make sure to enter the passcode prompted. If you don’t, the prompt goes away in a few seconds, and the backup is created without a password. 

18. ./EIFT_cmd normal backup -o ./

19. If you are creating a large backup, you may want to use an external disk as a destination. In that case, use the following syntax:
    
    

20. ./EIFT_cmd normal backup -o /Volumes/DISKNAME

21. DISKNAME is the name of the disk as displayed in Finder. Note that the backup contains multiple files. If you need to attack the backup password, you will only need a single file named manifest.plist.
    
    
22. If you have manually enabled a backup password during Step 7, remove that temporary backup password. If you haven’t, iOS Forensic Toolkit will automatically remove the temporary password. Either way, the device prompt for a screen lock passcode. The prompt will be shown for a limited time. If you miss the prompt, the command will finish, while the temporary password will  still be enabled on the devide. In this case, you will have to manually remove the backup password. In the example below, “123” is the previously set password. It must be provided as an argument: 

23. ./EIFT_cmd normal backuppwunset -p "123"

24. Extract media files via afc. Note that the afc protocol returns media files regardless of the backup password, and is available on Apple TV and Apple Watch devices as well as the iPhone and iPad. In addition to photos and videos, afc returns valuable metadata. 

25. ./EIFT_cmd normal dumpafc -o afcdump.tar

26. If you need to save the file in a different folder or disk, use the following syntax (also applies to subsequent commands):
    
    

27. ./EIFT_cmd normal dumpafc -o /Volumes/DISKNAME/afcdump.tar

28. On the iPhone, generate sysdiagnose logs. To do that, hold Vol+, Vol- and Power buttons for 250 milliseconds, then wait up to 5 minutes.
29. Pull crash logs and diagnostic (sysdiagnose) logs: 

30. ./EIFT_cmd normal dumpcrash -o crashlogs.tar

31. Extract shared files (the command below uses a file named “container.tar” in the current folder): 

32. ./EIFT_cmd normal dumpshared -o container.tar

33. Decrypt the backup with Elcomsoft Phone Breaker or open it directly in Elcomsoft Phone Viewer providing the known backup password (e.g., 123).

./EIFT_cmd info
./EIFT_cmd normal backup -o ./
./EIFT_cmd normal dumpafc -o afcdump.tar
./EIFT_cmd normal dumpcrash -o crashlogs.tar
./EIFT_cmd normal dumpshared -o container.tar

%ProgramData%AppleLockdown

%AllUsersProfile%Application DataAppleLockdown

/var/db/lockdown

./EIFT_cmd info -r record.plist

 By Oleg Afonin at 2022-11-15 14:32:20 Source ElcomSoft blog: