±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36779
New Yesterday: 2 Visitors: 178

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iPhone - Encase

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts


iPhone - Encase

Post Posted: Jun 22, 09 16:04


I'm just doing a jealbroken iPhone. Rolling Eyes
First i got data.bin out of the XACT-File. Then i converted the .bin with the FTK Imager to a .E01.
So, if I open the .E01 in Encase, i'm only getting 1 big unallocated cluster...
Does someone know, where the problem is and how I can fix it?

Perhaps I wouldn't have the problem, if I would get a .dd-File out over WIFI. But I think that shouldn't be the problem.

Patrick Mr. Green  

Senior Member

Re: iPhone - Encase

Post Posted: Jun 22, 09 18:04

I'm not familiar with the file system that the iPhone uses, but unless you can point encase to a logical partition I think all you will see are the unallocated clusters  


Re: iPhone - Encase

Post Posted: Jun 22, 09 18:15

no no....I got it this moment...
I had to change the identifier from HX to a H+. The rest is everything hfs+....don't know why the identifier was HX.
ok, now I have to do the rest... Cool  

Page 1 of 1