Data Acquisition from iOS Devices - Practical Mobile Forensics - page 88

The command in the preceding screenshot creates the iphone-dataprotection dir-
ectory and downloads iPhone Data Protection Tools to it.
Building the IMG3FS tool
Build the IMG3 FUSE file system from the img3fs directory. This module enables you
to directly mount the firmware disk images included in the iOS firmware packages
(IPSW), as shown in the following command lines:
$cd iphone-dataprotection
$sudo make -C img3fs/gcc -o img3fs img3fs.c -Wall
-lfuse_ino64 -lcrypto -I/usr/local/include/osxfuse || gcc
-o img3fs img3fs.c -Wall -losxfuse_i64 -lcrypto -I/usr/
local/include/osxfuse
img3fs.c: In function
'img3_check_decrypted_data':img3fs.c:100: warning: pointer
targets in passing argument 2 of 'strncmp' differ in
signedness
img3fs.c:104: warning: pointer targets in passing argument
2 of 'strncmp' differ in signedness
img3fs.c:108: warning: pointer targets in passing argument
2 of 'strncmp' differ in signedness
[...]
After running the make command, you will notice a few compiler warning messages,
which you can ignore.
Downloading redsn0w
Firmware disk images included in the iOS firmware packages are encrypted. The red-
sn0w application, a famous iOS jailbreaking utility developed by the iPhone Dev Team,
contains a plist file with the decryption keys for all previously released iOS firmware
images. The iPhone Data Protection build scripts will use the decryption keys to automat-
ically decrypt the kernel and ramdisk. To do this, download the latest version of redsn0w
and create a symbolic link to its Keys.plist file in the current directory, as shown in
the following code. Later in this chapter, you will also use redsn0w to boot the custom
ramdisk onto the device.