Universal, Fast Method for iPad Forensics Imaging via USB Adapter

Author

Gómez-Miralles, Luis ; Arnedo-Moreno, Joan

Author_Institution

Comput. Forensics & Electron. Evidence Investigator, INCIDE-Investig. Digital, S.L., Valencia, Spain

fYear

2011

fDate

June 30 2011-July 2 2011

Firstpage

200

Lastpage

207

Abstract

The Apple iPad is a popular tablet device presented by Apple in early 2010. The idiosyncracies of this new portable device and the kind of data it may store open new opportunities in the field of computer forensics. Given that its design, both internal and external, is very similar to the iPhone, the current easiest way to obtain a forensic image is to install an ssh server and some tools, dump its internal storage and transfer it to a remote host via wireless networking. This approach may require up to 20 hours. In this paper, we present a novel approach that takes advantage of an undocumented feature so it is possible to use a cheap iPadaccessory, the Camera Connection Kit, to image the disk to an external hard drive attached via USB connection, greatly reducing the required time.

Keywords

Apple computers; computer forensics; electronic data interchange; notebook computers; system buses; Apple iPad forensics imaging; USB adapter; USB connection; camera connection kit; computer forensics; data storage; idiosyncracies; portable device; remote host; tablet device; undocumented feature; wireless networking; Computers; Connectors; Forensics; IEEE 802.11 Standards; Imaging; Software; Universal Serial Bus; Apple; cybercrime; digital investigation; forensics; iPad;

fLanguage

English

Publisher

ieee

Conference_Titel

Innovative Mobile and Internet Services in Ubiquitous Computing (IMIS), 2011 Fifth International Conference on

Conference_Location

Seoul

Print_ISBN

978-1-61284-733-7

Electronic_ISBN

978-0-7695-4372-7

Type

conf

DOI

10.1109/IMIS.2011.41

Filename

5976186