Devices & iOS Versions: See List Of Supported IOS Devices
Type of Capture: Physical
Procedure:
- Ensure both "Apple Application Support" and "Apple Mobile Device Support" have been installed (these are installed with either the MPE Smartphone Driver or iTunes).
- Connect the device with the normal Apple USB cable.
- Click the "Select Device" button on the Main toolbar in MPE+.
- Select "Apple" in the Manufacturer drop-down.
- Select the correct device with the "(Physical)" label in the Model drop-down.
- Click "Connect" and follow the on-screen prompts to put the device in DFU mode.
- If the device has a password, select the option to brute force the password, enter the password, or just extract the deep logical TAR files.
- When prompted, select which partitions to acquire and proceed to acquire the data.
Notes:
- If MPE+ reports that the device is not ready, try unlocking the device and opening Settings, then trying to connect again
- Apple Physical images will be saved in DD format.
- Apple Deep Logical images will be saved in TAR format.
- MPE+ will name an Apple device's physical images in the format [partition_name].[timestamp].[image_type].[segment_number]. Changing these file names may result in not being able to correctly read the images
- The OS partition will usually require at least 1 GB of disk space on the destination PC. The other partitions require at least as much space as the Apple device is rated to hold. This means that selecting to acquire the OS Partition, User Partition, Decrypted User Partition, and Full Disk from a 32 GB Apple device will result in about 96 GB worth of image files.
- The iOS Parser may not be able to automatically parse out all data types on all images.