2

I would like to be able to run a forensic analysis on my iPhone from a disk dump copy made on my Mac or any kind of Unix as I would from any external disk with a dd command.

(For those who are curious: to detect malware, data leaks, to check what is encrypted, what isn't… )

How may I proceed to see my iPhone as a normal disk?

How may I decrypt the dump obtained since I know my password, but not how is built the AES key from it?

2

You can read about how the encryption is performed and how the AES keys are built in Apple's iOS Security Guide:

https://www.apple.com/business/site/docs/iOS_Security_Guide.pdf

In particular this describes that the key is not available to the application processor. It is only available within the Secure Enclave. This means that even though you know your password, you cannot rebuild the AES-key from it on a different computer.

This means that it is not possible to do what you want (i.e. dumping the raw disk contents and decrypting it on another computer using AES keys that you build from your own password on that computer).

In regards to dumping raw disk content, you can use the dd command if you want - but you cannot really use it for anything.

  • Professional firms do offer to do forensic work on ios devices. – historystamp Aug 8 at 0:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .