Data Acquisition from iOS Devices - Practical Mobile Forensics - page 109

Download kernel_patcher from https://code.google.com/p/iphone-dataprotection/is-
sues/detail?id=49&q=a5 and move it to the ramdisk_tools folder with the following
command:
$mv ~/Downloads/kernel_patcher ~/Documents/
iphone-dataprotection/
Copy kernel_patcher , bruteforce , and device_infos scripts to the iPhone
using the scp command:
$cd ramdisk_tools
$scp -P 2222 kernel_patcher device_infos bruteforce
root@127.0.0.1:/var/root/
Enter alpine as the password and hit Enter .
Run the ssh command and grant execute permissions to the uploaded scripts with the fol-
lowing:
$ssh root@127.0.0.1 -p 2222
Enter alpine as the password and hit Enter :
iPhone# chmod +x kernel_patcher bruteforce device_infos
Run the kernel_patcher and bruteforce scripts. It patches the kernel, brute
forces the passcode, decrypts the System keybag, and creates a plist file on the iPhone
root directory, as shown in the following command lines:
iPhone#./ kernel_patcher
iPhone#./bruteforce
Writing results to f04d282cc7182d47.plist
[...]
Copy the plist file from the iPhone to the desktop using the scp command:
$scp -P 2222 root@127.0.0.1:/var/root/
f04d282cc7182d47.plist .
To decrypt the disk image, run emf_decrypter.py , as follows: