Now, this one is really cool.
This is iBackupBot.
And I'm going to connect my iPhone here and show you what
this is going to look like.
iBackupBot runs live on the iPhone.
It's also something that you can use to parse backup files,
but we don't want to do it for that.
What we want to do is get these special log files.
And I will show you my blog as well after this,
because it's very important that you understand
what we're going to do.
So I'm going to connect this to Windows.
I'm going to switch inside of my VM, make sure it's connected.
I do not recommend doing acquisitions inside of the VM,
because you'll see sometimes there
are issues with getting everything to connect.
I need to make sure that my phone is trusted.
I don't see the iPhone yet.
All right, we're going to see if this works.
We'll see if it sees my iPhone.
I'm clicking on iBackupBot.
And you will get errors where it says, hey, I can't load this.
That's because it's an encrypted backup.
So we're switching to the VM.
And I am looking at this.
It says there's a connection error with iBackupBot.
I have to click Trust on the iPhone,
and then say, yes, I want to retry.
Again, what we want to do is we want
to look at this live device.
And this is something that you should do
at the end of your acquisition.
And I will reference that blog.
And it looks like my iPhone's having a hard time
staying connected.
Let me see.
This is why you don't want to do this inside of a VM,
if possible.
Now, if I zoom in over here, we could
see it's going to show you the name of the iPhone.
But under Tools right here, this is where this gets interesting.
There's something called a system log.
This is everything that is running live
on that iPhone right now.
So if you have messages that are coming in, or airdrops,
or something that keeps happening on the device,
you could look at those system logs.
You can also export them.
But crash reports-- crash reports are amazing.
And I'm going to talk more about system diagnostics logs
and anything else.
But as the person's using an app, if it crashes,
a crash report is created.
So think about in section 2, when
we were trying to prove application usage.
These crash logs will be helpful.
So what the device is doing right now
is going through and collecting all of these crash logs.
When it's done, I want you to press Export and save it
to your case directory.
If you don't need them, fine, but you've
collected them just in case.
So while this is thinking, I want to go to my blog.
OK, I'm going to smarterforensics.com,
and under Blog, the Android and iOS acquisition--
now we want to take a look at the iOS recommendations.
So we talked about Android.
For iOS, I talk you through installing iTunes,
downloading that iBackupBot-- which is called iCopyBot--
and also ArtEx, techs if you're going
to be looking at Ian's tool.
And then I did a full file system checkm8.
That's my preferred method.
If you do an advanced logical or an iTunes, you must encrypt
or you're going to miss information.
And then I talk about iBackupBot and exactly what
I'm showing you here.
Connect that phone.
Export all of those crash logs.
And then I take it even a step further
and talk about collecting sysdiagnose logs
and how to extract them.
That will be covered more in this course.
But follow these steps if you want
to get a thorough acquisition.
Now, as we look at this, we could see retired logs.
Those are old logs.
Any panics-- and a panic is when you hit the home and the power,
and you feel that little haptic vibration on your device.
That's a panic, where you could call SOS.
Then we have all these daily logs, journals.
There's a lot of information on here.
Low battery log-- that's interesting.
Siri search-- so as Siri is failing or saying,
I don't know what you mean, I'm not
connected to this, that's all in these text files.
It's very important that you look at these
for certain investigations.
And we'll talk about the specific ones
that you will care about.