Backups and Backup Structure (iOS and Android)

Connecting Android Devices: ADBSearch on YouTubeBookmarkSaved

Android Debug Bridge (ADB) is a communication protocol developed for Android. It lets a device talk to a host (PC).

• Used to talk to the device, push/pull data directly, install applications, open a Linux-based shell, and more.
• To enable it, open Settings and turn on Developer Mode by tapping the build number.
• Forensic tools use ADB to extract a full memory image or a device backup, and to install custom apps that extract data.
• ADB has three pieces: a client and a server that run on the host computer, and a daemon (adbd) that runs in the background on the Android device.
• USB debugging could bypass handset lock codes and give deep access. So Android 4.3 added a security gate: the user must authorise the computer the device is attached to ("Allow USB debugging?" with the computer's RSA key fingerprint).

getprop is one of the only guaranteed ways to check whether a device is encrypted and which method is used:

adb shell
getprop | grep crypto

[ro.crypto.metadata.enabled]: [true]
[ro.crypto.state]: [encrypted]
[ro.crypto.type]: [file]
[ro.crypto.volume.filenames_mode]: [aes-256-cts]

Here ro.crypto.type = file means FBE; block would mean FDE (see L02).

Quick Images in AXIOMSearch on YouTubeBookmarkSaved

An AXIOM Quick Image of an Android device combines four methods:

1. ADB capture of the SD card
2. Agent application extraction
3. ADB backup
4. Acquire live data

Data duplication: AXIOM runs an ADB backup command that captures the SD card area, and also does an ADB capture of the SD card. If both work, the data is duplicated.

Live DataSearch on YouTubeBookmarkSaved

Live data is lost if the device is turned off. Examiners should capture all available data before powering off.

1. Device date time UTC
2. Device properties: IP information, roaming information, SIM information, time zone, serial number, encryption type (Yes/No, FDE/FBE)
3. Task statistics *
4. Usage statistics (app usage and movement) *
5. Wi-Fi statistics

Items marked * give more data if the device is still powered on. The others are more static. Live data is collected with a combination of logcat and getprop commands through an ADB shell.

Agent ApplicationSearch on YouTubeBookmarkSaved

• A technique that injects a custom APK into the device. It extracts information through the "service providers" (content providers) or API calls that Android offers.
• It obtains only active information, not deleted information.
• Once injected, the APK installs automatically, and AXIOM accepts any permission prompts on screen.
• Android 10 or below uses the agent app. Android 11 onwards uses Live Data to capture this information.

The agent tries to collect:

• Accounts listed on the device
• Bluetooth devices known by the device
• Browser history
• Calendar information
• Call logs
• Downloads
• Contacts
• SMS/MMS messages
• SIM card information
• Device spellcheck dictionary
• Wi-Fi information

Android Backup Structure in the Quick ImageSearch on YouTubeBookmarkSaved

The Quick Image zip has four sections:

• ADB backup data contains any app that allows backup, plus information from /sdcard/.
• The tarball has two folders: apps and shared.
  • apps: everything from the main /data/data/ directory that was set to be backed up.
  • shared: data from /data/sdcard/ (or /data/media/). It contains a numbered folder, usually 0, the primary user. Extra numbered folders indicate secondary users signed in to the device.

iOS AcquisitionSearch on YouTubeBookmarkSaved

Two routes: iTunes-style backups and the open-source libimobiledevice.

Devices and PairingSearch on YouTubeBookmarkSaved

• Users install iTunes (or Apple Devices) on a PC for backup. Forensically, backups may be found on the user's PC.
• Once iTunes is installed, Windows assigns a driver at C:\Program Files\Common Files\Apple\Mobile Device Support\Drivers.
• To check the driver is applied: right-click Windows, open Device Manager, then USB devices (look for "Apple Mobile Device USB Composite Device").

USB Restricted ModeSearch on YouTubeBookmarkSaved

• A timer disables USB communication once the user locks the device.
• Setting: Settings → Face ID & Passcode / Touch ID & Passcode → USB Accessories.
• Accessories cannot connect (only charging) when it has been more than an hour since the iPhone was locked.
• If USB Restricted Mode is OFF, the phone is in AFU, and the computer already has a valid pairing record, you can connect and transfer data without the passcode, even while the phone is locked.
• If the computer was never trusted, a new trusted session cannot be established without the passcode or biometric input on the phone.

Lockdown ModeSearch on YouTubeBookmarkSaved

• iOS 16 or later: Settings → Privacy & Security → Lockdown Mode.
• An extreme security setting against highly targeted spyware (such as Pegasus).
• It blocks most message attachments, link previews, etc. This shrinks the attack surface for zero-click and remote exploits but reduces functionality.
• It disables wired connections (USB, accessories) when the device is locked.
• Forensic angle: stricter than USB Restricted Mode. Wired connections are cut whenever the phone is locked, regardless of the USB Accessories toggle. Physical acquisition becomes very difficult.

Pairing CertificateSearch on YouTubeBookmarkSaved

• When the user taps "Trust", a file is created on the host PC in C:\ProgramData\Apple\Lockdown.
• The file is a binary property list (plist), called a pairing certificate (pairing record).
• It lets the host save and exchange 2048-bit RSA public keys.
• The keys start an encrypted SSL session before the device sends data to the host.

Conditions that revoke the authorisation. Once revoked, the passcode must be entered to re-establish trust.

Using a Suspect's Pairing RecordSearch on YouTubeBookmarkSaved

• The certificate lets iTunes talk to the device even when it is locked. So it can potentially bypass the handset lock code.
• If a pairing record is found on a suspect's PC, extract it and place it in the forensic machine's C:\ProgramData\Apple\Lockdown folder.
• The device then believes it is already authorised on the examiner's PC.
• This bypasses the "Trust This Computer" dialog and allows communication without the passcode, as long as the device is in AFU state.
• With that trust, tools (Cellebrite UFED, Magnet AXIOM, libimobiledevice) can do a logical acquisition (backup, app data, photos, etc.).

Backup Encryption ChallengesSearch on YouTubeBookmarkSaved

• Users can encrypt backups stored locally on a computer.
• With a password set, more data is saved: HomeKit, HealthKit, Apple Maps, Wallet, Call Logs, Safari History and keychain data.
• Apple cannot help the user break or reset the password.
• In older backups, Manifest.plist contained the decryption keys. The user's password had an iOS-generated salt applied and was run through PBKDF2 (Password-Based Key Derivation Function 2) for 10,000 iterations to make a pseudo-random key.
• iOS 10.2 made a major change:
  • Apple now encrypts the entire Manifest.db file, not only the records in it.
  • The key generation became much stronger. The password gets a salt (stored in Manifest.plist), then runs through PBKDF2-SHA256 ten million times. That key gets a second salt and runs through PBKDF2-SHA1 ten thousand more times.
  • Brute-forcing the password becomes much harder.

Resetting the backup password. An examiner can reset backup encryption on an unlocked device and make a fresh encrypted backup with a known password.

• On iOS 11 or later: Settings → General → Reset → "Reset All Settings".
• This erases the backup encryption password. It does not remove user files or messages, but it clears:
  • Display brightness
  • Home screen layout
  • Wallpaper
  • iTunes backup passcode

Apple File Conduit (AFC)Search on YouTubeBookmarkSaved

• AFC is an iOS service that lets a computer access certain parts of the iPhone file system over USB. Data can be exchanged only within the directories it is tied to.
• These hold Camera Roll (pictures and videos), purchased eBooks, iCloud stream and share information, and ringtones.
• Magnet AXIOM and Magnet ACQUIRE use both AFC and the iTunes backup process to get the maximum data.
• If the user set backup encryption, acquire AFC before resetting the backup passcode.

Sysdiagnose LogsSearch on YouTubeBookmarkSaved

• Logs that add to the backup. They must be generated before they can be captured.
• Press Volume Up + Volume Down + Power together for 1.5 seconds. The device vibrates to confirm.
• Generation takes 5 to 10 minutes.
• Find them under Settings → Privacy → Analytics & Improvements → Analytics Data, in a file beginning with sysdiagnose_.

libimobiledevice: Command-line AcquisitionsSearch on YouTubeBookmarkSaved

• Lets Linux users talk to iOS devices without iTunes (Apple does not make iTunes for Linux).
• It can pair/validate the device with the PC, get device information and make backups.
• AXIOM ships it at \Program Files\Magnet Forensics\Magnet AXIOM\AXIOM Process\libimobiledevice\. Open cmd at that location to use it.

idevicepair pair                 # start pairing; confirm "Trust" on the device
ideviceinfo                      # device identifiers and settings
idevicedate                      # current device time
idevicebackup2 backup --full c:\users\[username]\desktop\iPhoneBackup
idevicecrashreport               # crash logs and sysdiagnose files

UDIDsSearch on YouTubeBookmarkSaved

The unique device identifier (UDID):

• Identifies which device was backed up in a backup structure.
• Names the pairing record in the \Lockdown\ folder, linking the PC to a specific iOS device.
• Is saved in the USB Devices registry keys of a Windows PC, so the examiner can tell if a device was previously connected.

UDID Format: A12 and LaterSearch on YouTubeBookmarkSaved

New format: four leading zeros + ChipID + "-" + Device ECID, for example 00008020-001C2D9E0EE2002E.

• ChipID: a 16-bit unsigned integer showing the chip type (A12, A13...). Example: 8020 (hex) for A12.
• ECID (Exclusive Chip ID): in hexadecimal, a unique identifier for every Apple SoC. A 16-digit / 64-bit value. Read it with ideviceinfo -k UniqueChipID.
• Useful when locating pairing certificates or USB device entries in the Windows Registry.

UDID Format: A11 and EarlierSearch on YouTubeBookmarkSaved

• A 40-character hex value (20 bytes): a SHA1 hash.
• The input is a 60-character string (59 on later devices) formed by joining four values:
  1. Serial number
  2. IMEI (iPhone 4 and earlier) or ECID (newer than iPhone 4)
  3. Wi-Fi MAC address
  4. Bluetooth MAC address

Detecting a Spoofed UDIDSearch on YouTubeBookmarkSaved

• The UDID can only be modified on a jailbroken device.
• A jailbroken device can spoof the UDID at the OS/software level. ideviceinfo -k UniqueDeviceID then returns the spoofed value if system frameworks are patched.
• Manifest.plist in a backup can also hold a spoofed UDID if device-side libraries were tampered with before the backup.
• Validation: get the ECID from the device with ideviceinfo. It is returned under UniqueChipID in decimal. Convert it to hex and rebuild the UDID (ChipID-ECID on A12+, or the SHA1 formula on A11 and earlier). Compare with the reported UDID.

ideviceinfo -k UniqueChipID      # ECID, in decimal -> convert to hex
ideviceinfo -k UniqueDeviceID    # UDID as reported (may be spoofed)

UDID in the Windows RegistrySearch on YouTubeBookmarkSaved

• When an iOS device is connected, Windows creates a registry value with the UDID.
• This happens even if the device is not trusted, and without the iTunes driver.
• All Apple devices have Vendor ID (VID) 05AC.
• Most newer iPhones have Product ID (PID) 12A8; iPads have 12AB.
• Expanding such a key shows the UDID of each device connected to the PC (under HKLM\SYSTEM\CurrentControlSet\Enum\USB\VID_05AC&PID_12A8).

The AXIOM iOS Quick ImageSearch on YouTubeBookmarkSaved

The iOS quick imaging process combines:

• the iTunes-style backup,
• acquisition of all available media using the Apple File Conduit, and
• a capture of Live Data from the ideviceinfo command.

The result is a single .zip file.

Understanding the iOS Backup StructureSearch on YouTubeBookmarkSaved

SHA1-named FilesSearch on YouTubeBookmarkSaved

• Apple takes files from the device, strips the extension, renames them and stores them in the backup.
• Files keep their original headers, so they can still be opened and explored.
• Files are renamed to a hash value with no extension.
• Example: SMS/MMS and iMessages live in sms.db, at /private/var/mobile/Library/SMS/sms.db on the device.

DomainsSearch on YouTubeBookmarkSaved

• Apple uses a relative "domain" in place of part of the file system path. The list is in domains.plist on the device.
• The SMS database uses HomeDomain to replace the first part of the path, /private/var/mobile/.
• To find sms.db in the backup, compute the SHA1 of the path HomeDomain-Library/SMS/sms.db. That SHA1 hash is the file name.

echo -n "HomeDomain-Library/SMS/sms.db" | sha1sum

Mapping the Data: Manifest.dbSearch on YouTubeBookmarkSaved

• Four files, Manifest.db, Manifest.plist, Info.plist and Status.plist, do not exist on the device in this form. They are generated during backup as informational files referencing the device data.
• Manifest.db is an SQLite database that tracks each file and its original name and location on the device. (Practical: explore Manifest.db in Magnet AXIOM.)

The Three Configuration Plist FilesSearch on YouTubeBookmarkSaved

• Contain important information about the backup and the device it came from.
• Two plist formats: binary plists (header bplist00, not easily human-readable) and XML plists (human-readable). Info.plist is an XML plist.
• Both formats use a key-value structure.

Info.plist contains:

• Device Name
• Display Name
• GUID
• ICCID
• IMEI
• Installed Applications
• Last Backup Date
• MEID
• Phone Number
• Product Type
• Product Version (iOS version)
• Serial Number
• Unique Identifier (UDID)
• iTunes Version

Manifest.plist stores data about the backup and the apps on the device (overlaps with Info.plist). It also holds the encryption salt and keys for encrypted backups.

Status.plist stores the backup state, the date and time of the backup, and the UDID.

Quick self-testSearch on YouTubeBookmarkSaved