Digital Forensics report
Report of Examination
Silvius Laboratory
North Bend, Oregon
Case # SEC355_Week4
September 24, 2021
Examiner – Jennifer Silvius
Physical Evidence for Case SEC355_WEEK4
CP1: One (1) Apple iPad mini 2 (Serial number – F4KLX4RJFCM5)
The listed item under “physical evidence” of the report followed the proper chain of custody during the
analysis process and has been turned over to law enforcement (Brunty, 2021).
Objectives:
I have been asked to identify whether this device has been jailbroken. If the device has been
jailbroken, I have been asked to identify with what application was used. Additionally, I have
been to identify any social media applications downloaded and searches that were completed
using a search engine. Finally, I have been asked to identify the model of the device, unique
identification number, model, and version of the OS in use.
Mobile Device Forensic Examination:
On September 24, 2021, I completed an acquisition on an iPad2, using Magnet Axiom
(v.2.10.1). I was instructed to pull a file off of a windows 7 virtual machine and analyze this
device and look for several different artifacts such as device information, application
information, and search information.
• Analysis #1 – File f68CA861554485DA92BEDB927C5A0FE5F79D7274 was
downloaded onto Magnet Axiom on September 24, 2021. Steps were taken to ensure that
no evidence would be altered or lost during the downloading process. After thoroughly
checking the web-related artifacts, I discovered three recent search terms listed under iOS
safari, which were as follows "Meth bust," "list of motivational words," and "Donald
Trump."
• Analysis #2 – I was asked to identify the device along with the personal identification
number and operating system version. The product under analysis is an Apple iPad Mini
2. However, the model identification shows as an Apple iPad4. This is an indication that
the iPad has been jailbroken at some point. The system is running off of iOS 9.3.3, which
makes me wonder if the individual jailbroke the iPad to get the more up-to-date operating
system of iOS. As noted, before, the serial number is F4KLX4RJFCM5. The UIN
(Unique Identification Number) is
f68CA861554485DA92BEDB927C5A0FE5F79D7274.
• Analysis #3 – I have identified that there are 71 downloaded applications on this device.
Of the 71 applications that have been downloaded on this device, several fall into the
social media communication type of applications. The following applications have been
identified Facebook, Text Free with Voice, Twitter, mobile me, and media Social Share.
All these applications are third-party applications that promote either social media or
communications.
• Analysis #4 – Additionally, there has been a jailbreaking tool installed on this device
called StorekitUI service. After searching the browser history, I was able to locate the
website Jailbreakme9.com.
Findings
As Suspected, the mobile device was indeed Jailbroken; the device user may be involved
in drugs and maybe a fan of Donald Trump. However, there is not enough evidence, and
at best, the evidence is circumstantial. In addition, the device has multiple social media
applications on device which involve alternative ways of communicating. Overall, other
than jailbreaking the device, nothing indicates any crime related to the device at hand.
Reference
Brunty, J. (2021, February 4). Writing dfir reports: A primer. Forensic Focus. Retrieved
September 25, 2021, from https://www.forensicfocus.com/articles/writing-dfir-reports-aprimer
Comments
Post a Comment