>> Hey, everyone. Welcome back to the course.
In the last video, we wrapped up
our discussion on Android devices.
In this video, we're going to talk about iOS devices.
So our iOS architecture,
we have our Core OS layer,
things like your Bluetooth,
external accessories, or core services layer,
things like the iCloud, in-app purchases, SQLite.
Media layer, as the name implies,
things like our graphics,
audio, or video files.
Then our Cocoa Touch, your storyboard,
documents, and then things
like our notifications as well.
You'll just want to understand
these different components of
the iOS architecture for the exam.
The iOS boot process,
the normal boot process,
we're going to visualize
some components and then also check
signatures of the lower level bootloader or the LLB.
Then we move into the LOB where that's
loaded and then check the signature of the iBoot,
which is a stage 2 bootloader.
Then the iBoot is loaded and checks
a kernel and also the device tree signatures.
Then from there we move into
the kernel and the device tree is being
loaded and then the kernel checks
the signature of all user applications.
Now if we launch this in DFU,
which we'll talk about in just a little bit.
But if we launch it in DFU,
then we have the BootROM, then iBSS, and then iBEC.
Then the kernel and RamDisk.
We eliminate the iBoot in that process.
What is DFU mode?
Well, this is a mode called Device Firmware Upgrade.
This allows your device to be restored from any state,
not like a normal restore.
This is like allowing us to restore it from any state.
As an investigator, this is a good tool for
users to get information from the device.
Disk Image of iPhone with SSH,
number 1, it has to be jailbroken.
The iOS phone has to be jailbroken.
Then this allows us to get an image
of the whole disk of the phone.
Similar to the dd command
that we talked about earlier in this course,
similar to that command.
Again, to get that bit by bit copy.
One way we can bypass,
but bypass an iPhone passcode
is using a tool called iExplorer.
Just remember that for your exam.
If you need to bypass an iPhone passcode
and you see iExplorer,
that's probably the answer.
iOS rooting, you'll notice a difference here of
where android devices pretty
much always said, "Root in the name."
You'll see iOS rooting
or jailbreaking tools have a lot of different names.
That's why I mentioned with the Android 1 is
just kind of remember that Android is root.
That way it'll help you if you see
other answers or if you get
a question asking about, for example,
iOS devices and jailbreaking them,
you'll know that like any answer
listed that has root is probably not the right answer.
So just keep that in mind,
that really will help you on
the exam just in case it's asked.
Different tools we can use for
iOS jailbreaking are going
to be things like Pangu jailbreak,
Redsnow, GeekSnow, and SnowBreeze.
SIM cloning, if we want to clone
a SIM card on any device,
we can use a tool called
MOBILedit and remember that for your exam.
That'll allow us to get a logical acquisition.
Then we can also use oxygen forensic suite to
grab a physical and file system acquisition as well.
Cellular network components are
specific to iOS, but I want to mention them.
We have things like our CDMA or EDGE or iDEN.
Also the general packet radio service,
global system for mobile communications,
or time division for multiple access.
Again, just some different components.
You probably don't need to know
these for the exam itself,
I just wanted to mention them as
more as of a just-in-case type of thing.
Again, not specific to iOS devices,
but are things that you may possibly see on the exam.
Just a quick few post-assessment questions here.
Number 1, the iExplorer tool can
be used to bypass an iPhone's passcode,
is that going to be true or false?
That one's true. We talked about that
that tool is one that you can use
to bypass the passcode on an iOS device.
Again, just remember that for your exam.
Our next question, Redsnow
is used for root Android phones,
is that going to be true or false?
All right, that one's false.
If you remember that most Android jailbreaking tools
are going to be labeling as root in the name.
Redsnow is actually for iOS devices.
All right, in this module we talked about
different iOS device information
as well as some different information about
cellular networks in general.
In the next module, we're going to cover reporting.
That will actually be our last module of the course