If you are faced with the common problem of not being able to recover emails and documents from more recent iOS devices then this might be of interest to you! Previously examiners have been able to acquire physical reads from iOS devices which gave them access to the stored email data.
There is a way to easily recover emails of interest as well as some attachments to PDF files on a separate computer. We can utilise the ‘AirPrint’ protocol to ‘Print to PDF’ on a separate computer.
When I first wrote this up a few months back (but never got round to uploading) the solution was a bit more convoluted but now it really is dead simple. You need the following:
- Mac Computer running 64bit OSX
- Netputing’s handyPrint v4.x
- Dedicated secure wireless network with no internet connection
First job is to download the software (v4.x) from here:
http://www.netputing.com/handyprint/
I won’t guide you through the installation of the software, I’m sure you can manage that part.
Just a quick note: this version of handyPrint (4.x) should be compatible with iOS4.3, iOS5 & iOS6 and will run on OSX Snow Leopard (10.6), Lion (10.7) and Mountain Lion (10.8). Check with the software provider if in doubt.
Before you start this you need to configure your wireless network so that it is secure and has no active internet connection. I will leave it up to you to decide what level of security you require but I would expect a hidden SSID, WPA2 Key and no active internet connection. You should also ensure that you have a sound practice for connecting to the network as part of an examination.
One way you could do this would be to set the device to ‘Airplane Mode’ whilst in a faraday enclosure and then go into the WiFi settings and manually enter the network details to ensure that the phone will not attempt to connect to any other network, just the one you are intending it to. That way once you remove the device from the faraday environment it should automatically connect to the correct network.
The purpose of this guide is not to cover these details, its to show you a possible method you could employ for recovering emails or documents from these devices. Please make sure that you understand the task you are undertaking and are able to explain the process yourself if using this in an investigation.
Now let’s look at configuring the program itself.
1. Once you have installed the software you should configure the printing to PDF. You do this by selecting ‘Add Virtual Printer’ > ‘Save as PDF to Folder’. Now choose/create the folder you want to use.
2. Now (assuming the Mac is already on the secure network) connect the iOS device to the secure network.
3. Find the email or document on the device that you want to print to PDF
4. Use the menu option to ‘Print’
5. Select your printer, it should be fairly obvious. It will be the one that will save in the folder you created earlier
7. Check the folder on your Mac, it should have successfully printed and you can see an example here:
That’s it. Very simple. The same process can work for other documents or data types residing on the device such as documents in office programs.
No comments:
Post a Comment