Monday, February 7, 2011

iPhone Utilities for Mac

iPhone Explorer
http://www.macroplant.com/iphoneexplorer/

Backup Extractor
http://supercrazyawesome.com/

SQLite Database Browser
http://sourceforge.net/projects/sqlitebrowser/



Rescue Data after Recovery for Jailbreak

usbmuxd - iPhone SSH via USB
http://marcansoft.com/uploads/usbmuxd/usbmuxd-1.0.6.tar.bz2

cd usbmuxd-1.0.6/python-client
python tcprelay.py -t 22:2222 &


ssh command to recover user data partition using usbmuxd: (wait for about an hour and requires 29G for 32G iPhone)

ssh -p 2222 root@localhost dd if=/dev/rdisk0s2s1 bs=1M | dd of=iphone-user.img


ssh command to recover the system partition using usbmuxd:

ssh -p 2222 root@localhost dd if=/dev/rdisk0s1 bs=1M | dd of=iphone-root.img




To convert the raw disk image to HFS/+ dmg format (mountable by Mac), change the byte HX to H+ as below




scanning with scalpel 1.60
http://www.digitalforensicssolutions.com/Scalpel/

tar -zxvf scalpel-1.60.tar.gz
cd scalpel-1.60
make bsd
sudo mkdir -p /usr/local/bin /usr/local/etc
sudo cp -p scalpel /usr/local/bin
sudo cp -p scalpel.conf /usr/local/etc
scalpel -c scalpel.conf iphone-root.img

.
.
.

1 comment:

Anonymous said...

Hm, not totally sure I can do anything with the image once i have it. Scalpel can't find anything, and I can't mount it via finder.

Are you sure it's not encrypted?

Cheers - John