Information Technology Reference
In-Depth Information
Pairing records
When iTunes detects the iPhone, sets of pairing records are exchanged between the iPhone
and the computer. Pairing is the mechanism by which your computer establishes a trusted
relationship with your device so that iTunes can communicate with it. Once a computer has
been paired, it can access personal information on the device and can even initiate a backup
of the device. Similar pairing occurs in iOS 7 with commercial forensic tools.
On the iPhone, pairing records are stored in the /var/root/Library/Lockdown/
pair_records/ directory. The directory will contain multiple pairing records if the
device is paired with multiple computers. Pairing records are stored as a property list
( .plist ) file with a filename representing the unique identifier given to the computer.
Property list files are binary formatted XML-like files, explained in detail in Chapter 5 , iOS
Data Analysis and Recovery . Pairing records on the device contain the HostID, root certi-
ficate, device certificate, and host certificate. For example, the content shown in the follow-
ing screenshot was located in a pairing record on one particular iPhone with a file named
97D6299A-8EDA-454F-9C62-4BB031F45DD6.plist . Pairing records stored on
the iPhone are deleted only when the phone is restored to factory state.
Pairing records on the iPhone
On the computer, pairing records are stored in a preconfigured location depending on the
operating system as shown in the following table. Pairing records are stored as a property
list file with a filename representing the iPhone's unique device identifier. Pairing records
on the computer are known as lockdown certificates .
Operating system
Location
Windows
%AllUserProfile%\Apple\Lockdown\
Search WWH ::




Custom Search