Almost certainly no...
 
Notifications
Clear all

Almost certainly not "forensically sound" ...

19 Posts
7 Users
0 Likes
599 Views
azrael
(@azrael)
Posts: 656
Honorable Member
Topic starter
 

… but of investigation interest perhaps to some

http//www.macroplant.com/phonedisk/

Free for the time being for both Mac and PC to explore the iPhone directory structure.

 
Posted : 08/11/2010 3:39 pm
(@jelle)
Posts: 52
Trusted Member
 

Old discussion, but why not "forensically sound"? The tool will likely change data on the original device, but if you take a conscious decision to use this tool, are aware of the impact and artefacts and take proper notes of what you are doing, why not?

 
Posted : 08/11/2010 4:00 pm
azrael
(@azrael)
Posts: 656
Honorable Member
Topic starter
 

<sigh> Ok, that'll teach me to type "quick notes" before thinking … </sigh>

<takes deep breath and rephrases post as>
This tool is not a traditional forensic tool, is not written by forensic programmers (please see other posts) and is not accredited in any way for forensic use, and thus ( like all tools should be, accredited, forensic or otherwise ) should be verified as to it's behaviour, alteration caused and accuracy. If you fail to do so, may plauges of locusts visit your crops, may you be buried at low tide etc. etc. etc. You have been warned.
</tdbarpa>

I think that I'll change my signature to inculde this disclaimer 😉

( You _do_ have a point, however, I think that there is a place and time for everything, and a quick informative note to others isn't it … )

 
Posted : 08/11/2010 4:13 pm
(@jelle)
Posts: 52
Trusted Member
 

Haha, thumbs up for your reply 😉

I think there is definitely always a time for quick notes/ideas/links and these should of course not have to come with a ten-page disclaimer - however the fact that you were so clearly referring to "forensically sound" (which I really think is a term that is often mis-used or misunderstood) in your subject triggered me ) We as an industry should try to avoid the dogma that there is something as a "forensic approval" for tools or a "forensically accepted" method in which they work; if there's a need for a tool and you think you can justify its use -> go ahead.

I realise I'm preaching to the choir and that this was also not what you meant by your subject line, but there might be other readers of your quick note who misinterpret the subject line as a sort of disapproval of the use of this tool.

 
Posted : 08/11/2010 4:30 pm
azrael
(@azrael)
Posts: 656
Honorable Member
Topic starter
 

Haha, thumbs up for your reply 😉

Thanks -)

I think there is definitely always a time for quick notes/ideas/links and these should of course not have to come with a ten-page disclaimer - however the fact that you were so clearly referring to "forensically sound" (which I really think is a term that is often mis-used or misunderstood) in your subject triggered me ) We as an industry should try to avoid the dogma that there is something as a "forensic approval" for tools or a "forensically accepted" method in which they work; if there's a need for a tool and you think you can justify its use -> go ahead.

I realise I'm preaching to the choir and that this was also not what you meant by your subject line, but there might be other readers of your quick note who misinterpret the subject line as a sort of disapproval of the use of this tool.

You are absolutely right, and I must admit that it was a careless use of language on reflection. I, for one, often forget the impact of the forum on the readers, what I intend to be a throwaway line ends up being interpreted in all sorts of ways - some of the wonderful flame threads we've had here over the years show that I'm not the only one ! 😉

For all of you that have read this far, I neither endorse, nor reject this tool. A friend of mine pointed me at it just now, and I thought that it merited enough interest to pass on here. My subject line was meant to indicate that I had no knowledge of it's behaviour, particularly with regard to the preservation of evidence, and thus it should be treated as an unknown until such time as it has been verified. Jelle is absolutely right, that _any_ tool, given the correct handling can be useful, so long as you know what you are doing, and accept the limitations. My genuine thanks go for making this clearer.

 
Posted : 08/11/2010 4:43 pm
4Rensics
(@4rensics)
Posts: 255
Reputable Member
 

If I were you Azrel I would reject the tool! Its epic fail, literally! It just craps out as soon as I try to run it, gives me the standard windows error log screen!

Has anybody managed to run it?

 
Posted : 08/11/2010 5:29 pm
azrael
(@azrael)
Posts: 656
Honorable Member
Topic starter
 

I have - works fine on Windows 7 Ultimate 64-bit, HP 6530b 3Gb & iPhone 3G ( ok, I know the shame, but I had to keep my unlimited data plan, ok ? ), oh and you need iTunes 9 as well I seem to recall ?

It adds itself into the task bar where it sits and intercepts the iPhone plugin action.

 
Posted : 08/11/2010 5:38 pm
(@trewmte)
Posts: 1877
Noble Member
 

Yup no problems either. I mentioned this post and the link and one person who downloaded indicated they had a problem with it under Windows 7 but then discovered he had forgotten iTunes (version 9 or above) wasn't installed. Might seem obvious, but worth double checking maybe, perhaps?

 
Posted : 08/11/2010 5:48 pm
(@jonathan)
Posts: 878
Prominent Member
 

Write block the USB port that you plug the iPhone into and Bob's your uncle. 'Forensically sound' in the traditional sense.

 
Posted : 08/11/2010 6:03 pm
4Rensics
(@4rensics)
Posts: 255
Reputable Member
 

Oh right… I only put it on my laptop (Windows XP) ( as its connected to the web and our forensic machines are not on the web… and I don't have iTunes on it as I don't use it for forensic work. I really didn't think this through did I. I just wanted to see it running before I tried anything else. I would have thought it might have gave me an error log or warning saying no iTune found or no phone/pad/pod connected. It just fell on its a**e!

I might pop it over to the beast and give it a go on that (if were getting into PC wars… ) - Win 7 Ultimate 64bit, Intel Xeon 3.00GHz, 12GB RAM! Should work on that! lol

 
Posted : 08/11/2010 7:10 pm
Page 1 / 2
Share: