The date in the ist is often the same as the date in the ist and again this file does not track if the backup was successful or not. The ist is more helpful when it comes to dealing with locked backup files that need to be cracked.
It is often the completion datetime and doesn’t state if the backup was successful, which is why I rely on the ist, when the file is available. The ist also stores a datetime and whether the backup was successful (snapshot state), but it is not the start date.
OXYGEN FORENSICS 2FA PC
If you are looking at a backup that was extracted from a PC or a Mac, the ist will contain the start date and time for an iTunes backup.
OXYGEN FORENSICS 2FA UPDATE
The files we are going to examine for backup datetime activity include:Īll of these files are important, but the dates inside of each may vary and a smartphone tool may update the date inside of the file. Why? Because I know when I backup and I can then verify dates. For this test, I used my own iPhone that I use every day. I hope this blog makes your examination easier by breaking down what is happening for each file. If you are looking at a file system dump created by a tool, this is where the confusion may set in.
Are you looking at a backup file extracted from a PC or Mac? Are you looking at an iCloud backup? Are you looking at a file system dump created by a commercial or free tool? If you are looking at a backup (iTunes or iCloud) this process is a lot easier. The first thing to consider is what you are examining. So, when you are asked – “When did a user last create an iTunes or iCloud backup?” – You can answer with confidence next time. I have probably tested this more times than I should have, which is why I am finally putting it in writing. Every time this question comes up, I test it again. One point of contention in the FOR585 Advanced Smartphone Forensic class is – which files store the correct datetime for when a user created an iOS backup? I’ve engaged in a few friendly arguments over this topic and it recently popped up again when Lee was teaching in NYC in August.
0 kommentar(er)
