iPhone models

The most recent iPhones, the seventh generation iPhone 5C and iPhone 5S, were just released at the time of writing this book. Currently, there is no method or tool available to physically recover data from these devices. However, the file system and a logical acquisition can be obtained if the iPhone is unlocked. Acquisition methods for data extraction are available and will be discussed in Chapter 3, Data Acquisition from iOS Devices, and Chapter 4, Data Acquisition from iOS Backups.

Before examining an iPhone, it is necessary to identify the correct hardware model and the firmware version installed on the device. Knowing the iPhone details helps you to understand the criticalities and possibilities of obtaining evidence from the iPhone. For example, in many cases, the device passcode is required in order to obtain the file system or logical image. Depending on the iOS version, device model, and passcode complexity, it may be possible to obtain the device passcode using a brute force attack.

There are various ways to identify the hardware of a device. The easiest way to identify the hardware of a device is by observing the model number displayed on the back of the device. The following image shows the model number etched on the back of the casing. Apple's knowledge base articles can be helpful for this purpose. Details on identifying iPhone models can be found at http://support.apple.com/kb/HT3939.

iPhone model number located on the back of the case

The firmware version of an iPhone can be found by accessing the Settings option and then navigating to General | About | Version, as shown in the following screenshot. The purpose of the firmware is to enable certain features and assist with the general functioning of the device.

The iPhone About screen, displaying firmware Version 5.1.1 (9B206)

Alternatively, the ideviceinfo command-line tool available in the libimobiledevice software library (be used to identify the iPhone model and its iOS version. The library allows you to communicate with an iPhone even if the device is locked by a passcode. The software library was developed by Nikias Bassen (pimskeks), and it was compiled for Mac OS X by Ben Clayton (benvium).

Mac OS X can be installed in virtual machines for use on a Windows platform. To obtain the iPhone model and its iOS version information on Mac OS X 10.8, the following steps must be followed:

1. Open the terminal application.
2. From the command line, run the following command to download the libimobiledevice library:

   $ git clone https://github.com/benvium/libimobiledevice-macosx.git ~/Desktop/libimobiledevice-macosx/
   

   The command creates the libimobiledevice-macosx directory on the user's desktop and places the libimobiledevice command-line tools onto it.

3. Navigate to the libimobiledevice-macosx directory, as follows:

   $ cd ~/Desktop/libimobiledevice-macosx/
   

4. Create and edit the .bash_profile file using the nano command, as follows:

   $ nano ~/.bash_profile
   

5. Add the following two lines to the .bash_profile file, as follows:

   export DYLD_LIBRARY_PATH=~/Desktop/libimobiledevice-macosx/:$DYLD_LIBRARY_PATH
   PATH=${PATH}:~/Desktop/libimobiledevice-macosx/
   

   Press Ctrl + X, type the letter y and hit Enter to save the file.

6. Return to the terminal and run the following command:

   $ source ~/.bash_profile
   

7. Connect the iPhone to the Mac workstation using a USB cable, and run the ideviceinfo command with the -s option:

   $ ./ideviceinfo -s
   

   Output of the ideviceinfo command displays the iPhone identifier, internal name, and the iOS version as shown:

   BuildVersion: 9B206
   DeviceClass: iPhone
   DeviceName: iPhone4
   HardwareModel: N90AP
   ProductVersion: 5.1.1
   ProductionSOC: true
   ProtocolVersion: 2
   TelephonyCapability: true
   UniqueChipID: 1937316564364
   WiFiAddress: 58:1f:aa:22:d1:0a
   

Every release of the iPhone comes with improved or newly added features. The following tables show the specifications and features of legacy and current iPhone models:

The most recent iPhone features are shown in the following table:

One of the major changes in the iPhone 5, iPhone 5C, and iPhone 5S is the USB dock connector, which is used to charge and synchronize the device with the computer. Devices prior to the iPhone 5 use a 30-pin USB dock connector, whereas the newer iPhones use an eight-pin lightning connector.