iOS forensics tools

Supported devices (iPhone 2G) iPhone 3G iPhone 3GS iPad 1 iPhone 4 GSM iPhone 4 GSM rev A iPhone 4 CDMA Newer devices are NOT supported

Requirements Mac OS X 10.8/10.9 Xcode with iOS SDK (open Xcode to accept the license agreement) redsn0w_mac_0.9.15b3 (downloaded by build.py) Supported IPSW for the target device in data/ipsw (downloaded by build.py)

Building a custom ramdisk Run ./build.py DEVICE_NAME to create the patched kernel + custom ramdisk IPSW wont match the installed iOS version on the device, this is normal Use ./boot.py to start redsn0w with the correct parameters, then place the device in DFU mode

./build_ramdisk_v2.sh can be used to recompile ramdisk_tools and update existing ramdisks (data/boot/*.dmg)

SSH access Boot using ./boot.py wait for "OK" on screen Run ./tcprelay.sh in a new terminal window Run ssh -p 2222 root@localhost root password is alpine

Python scripts Install dependencies sudo easy_install M2crypto construct progressbar setuptools pyasn1 protobuf sudo ARCHFLAGS='-arch i386 -arch x86_64' easy_install pycrypto M2Crypto for OS X 10.9 curl -O http://chandlerproject.org/pub/Projects/MeTooCrypto/M2Crypto-0.21.1-py2.7-macosx-10.9-intel.egg sudo easy_install M2Crypto-0.21.1-py2.7-macosx-10.9-intel.egg