Information Technology Reference
In-Depth Information
Decrypting the data partition
The entire file system is encrypted with an EMF key, with the exception of actual files on
the file system, which are encrypted with other keys (the data protection class keys). The
EMF key is encrypted with the
0x89B
key. The
emf_decrypter.py
Python script in-
cluded in iPhone Data Protection Tools can be used to decrypt the raw disk image. This
script uses the raw disk image and keys in the aforementioned plist to decrypt all of the en-
crypted files on the file system, as shown in the following command lines:
$sudo python python_scripts/emf_decrypter.py
b716de79051ef093a98fc3ff1c46ca5e36faabc3/
data_20131209-1956.dmg
b716de79051ef093a98fc3ff1c46ca5e36faabc3/
f03d282cc7182d46.plist
Password:Using plist file
b716de79051ef093a98fc3ff1c46ca5e36faabc3/
f03d282cc7182d46.plist
Keybag unlocked with passcode key
cprotect version : 4 (iOS 5)
Test mode : the input file will not be modified
Press a key to continue or CTRL-C to abort
Hit
Enter
to continue the script execution:
Decrypting iNode1559014
Decrypting iNode3056993
Decrypting iNode3056996
Decrypting iNode6811
[...]
Decrypting AddressBook.sqlitedb
Decrypting AddressBook.sqlitedb-shm
Decrypting AddressBook.sqlitedb-wal
Decrypting AddressBookImages.sqlitedb
Decrypting AddressBookImages.sqlitedb-shm
[...]
Decrypting IMG_1117.JPG
Decrypting IMG_1128.PNG
Decrypting IMG_1139.JPG
[...]
