Information Technology Reference
In-Depth Information
402 used pages in block
LwVM header CRC OK
cprotect version : 4 (iOS 5)
iOS version: 5.1.1
Keybag state: locked
(iPhone4-data) /
Run the
bruteforce
command to brute force the passcode and unlock the keybag:
(iPhone4-data) / bruteforce
Passcode comlexity (from OpaqueStuff) : 4 digits
Enter passcode or leave blank for bruteforce:
Hit
Enter
and you will see the following command lines:
Passcode "" OKKeybag state: unlocked
Save device information plist to [b716de7905.plist]:
Hit
Enter
to save the encryption keys to a plist file (
b716de7905.plist
).
Run the
nand_dump
command as shown in the following command lines. It copies the
NAND image to the
dataprotection
folder.
(iPhone4-data) / nand_dump iphone4-nand.bin
Dumping 16GB NAND to iphone4-nand.bin
100% |############################################|
NAND dump time : 0:45:36.200233
SHA1: a16aa578679ef6a787c8c26a40de4b745a3ae179
Once the NAND image and the plist file are obtained, you can use
ios_examiner.py
and run the
undelete
command to recover the deleted files, as shown in the following
command lines:
$sudo python python_scripts/ios_examiner.py
iphone4-nand.bin b716de7905.plist
Loading device information from b716de7905.plist
Device model: iPhone 4 GSM
UDID: b716de79051ef093a98fc3ff1c46ca5e36faabc3
ECID: 1937316564364
Serial number: 870522V6A4S
