Notifications
Clear all

iPhone - Encase

3 Posts
2 Users
0 Likes
454 Views
(@naish77)
Posts: 3
New Member
Topic starter
 

helo

I'm just doing a jealbroken iPhone. roll
First i got data.bin out of the XACT-File. Then i converted the .bin with the FTK Imager to a .E01.
So, if I open the .E01 in Encase, i'm only getting 1 big unallocated cluster…
Does someone know, where the problem is and how I can fix it?

Perhaps I wouldn't have the problem, if I would get a .dd-File out over WIFI. But I think that shouldn't be the problem.

Thanks
Patrick mrgreen

 
Posted : 22/06/2009 4:04 pm
(@mobileforensicswales)
Posts: 274
Reputable Member
 

I'm not familiar with the file system that the iPhone uses, but unless you can point encase to a logical partition I think all you will see are the unallocated clusters

 
Posted : 22/06/2009 6:04 pm
(@naish77)
Posts: 3
New Member
Topic starter
 

no no….I got it this moment…
I had to change the identifier from HX to a H+. The rest is everything hfs+….don't know why the identifier was HX.
ok, now I have to do the rest… 8)

 
Posted : 22/06/2009 6:15 pm
Share: