Data Acquisition from iOS Devices - Practical Mobile Forensics - page 83

The forensic environment setup
The following steps explain how to use the iPhone Data Protection Tools on Mac OS X
10.8.5 with Xcode 4.6.1 and iOS 6.1 SDK (other versions should work with the same
steps). Assuming that you already have Xcode with UNIX tools installed, you will need to
install some additional command-line tools, Python modules, and binaries to build and use
the iPhone Data Protection Tools.
Downloading and installing the ldid tool
First, you need to download the ldid tool, which is used to view and manipulate code sig-
natures and embedded entitlements plist files of binaries. On Mac OS X, open the ter-
minal window and use the curl command, as shown, to download the Idid tool:
$curl -O http://networkpx.googlecode.com/files/ldid
% Total % Received % Xferd Average Speed Time Time Time
Current
Dload Upload Total Spent Left
Speed
100 32016 100 32016 0 0 52214 0 --:--:-- --:--:--
--:--:-- 279k
Grant execution permission to the ldid tool and move it to the bin directory in the usr
folder, using the commands shown:
$chmod +x ldid
$sudo mv ldid /usr/bin/
Verifying the codesign_allocate tool path
Create a symbolic link to the Xcode folder, as shown:
$sudo ln -s /Applications/Xcode.app/Contents/Developer /
iPhone Data Protection Tools require the codesign_allocate tool, which is present
by default if the UNIX tools were installed with Xcode. To find whether
codesign_allocate exists or not, use the command shown:
$which codesign_allocate/usr/bin/codesign_allocate