Apple iOS

After we have seen how to examine an Android-based smartphone, we now want to show you how to perform similar investigations on iOS-based devices. In the first section, we are using a Secure Shell (SSH) connection to the device and will show you how to get stored data from the keychain of a jailbroken iOS device.

In the second part of this section, we will use libimobiledevice. This library is a cross-platform library that uses the protocols to support iOS-based devices and allows you to easily access the device's filesystem, retrieve information about the device and it's internals, backup/restore the device, manage installed applications, retrieve PIM data as well as bookmarks, and so on. The most important fact is that the iOS-based device does not have to be jailbroken in order to be used— when dealing with libimobiledevice.

Getting the Keychain from a jailbroken iDevice

In many cases, it can be very helpful to get usernames and passwords of accounts that the user of the iDevice...