Skip to content

mobile-ios.md

Latest commit

 

History

History
221 lines (167 loc) · 7.48 KB

mobile-ios.md

File metadata and controls

221 lines (167 loc) · 7.48 KB
Raw

iOS — recovery workflows

iOS is the hardest target for NullVeil because:

  1. There is no dd for non-jailbroken iOS. Apple does not expose the block device to host machines.
  2. iCloud backups never touch your machine — they live in Apple's datacentres and can only be downloaded into a new iOS device.
  3. APFS deletes zero metadata aggressively — even with a full physical image, prior-state recovery is hard without snapshots.

This page covers the two paths that do work, with honest scoping on each.

Path 1: Jailbroken iPhone / iPad

If you have a jailbroken device (any iOS version), you can SSH in as root, dd a partition, and pipe it over the network to a desktop. The /private/var partition holds user data.

# From your desktop, ssh into the jailbroken device:
# (port 22 on iOS over USB needs `iproxy 2222 22` from libimobiledevice)
iproxy 2222 22 &
ssh -p 2222 root@localhost      # default password "alpine"

# On the device:
dd if=/dev/disk0s1s2 bs=4M | gzip -1 | nc desktop-host 5050

# On the desktop, before the dd runs:
nc -l 5050 | gunzip > ~/ios-private-var.img

(Or just dd directly to a remote file with dd … | ssh laptop 'cat > file.img'.)

Once you have the image:

sha256sum ~/ios-private-var.img > ~/ios-private-var.img.sha256

nullveil info ~/ios-private-var.img
# Should detect APFS container + volumes.

# Volume listing
nullveil ls --partition 1 ~/ios-private-var.img

# Carving — the principled fallback on APFS
nullveil carve ~/ios-private-var.img \
    --out ~/ios-carved/ \
    --types jpg,png,heic,mov,sqlite,pdf

What you can recover from a jailbroken APFS image

Type Recovery confidence
Photos (JPEG/HEIC) High — carving works well
Videos (MOV/MP4) Medium — fragmentation can truncate
SQLite databases (Messages, Contacts, Notes) High if live, Medium if deleted — carving recovers the file; the SQLite-level "deleted rows" are inside the file itself and need a sqlite-aware tool (sqlite_undelete, sqliteparse)
iMessage attachments High — carved as JPEG/MOV
App-private encrypted data None — keys live in the Secure Enclave

Path 2: Non-jailbroken iPhone / iPad

For a stock device, the path is backup-based, not image-based.

Step 1 — Create a local backup

Two ways:

A. Finder / iTunes

  • macOS (10.15+): Open Finder, select the connected iPhone in the sidebar, click Back Up Now.
  • Windows / older macOS: iTunes → device → Back Up Now.

The backup lands in:

  • macOS: ~/Library/Application Support/MobileSync/Backup/<UUID>/
  • Windows: C:\Users\<you>\AppData\Roaming\Apple Computer\MobileSync\Backup\<UUID>\

B. libimobiledevice (cross-platform)

# macOS: brew install libimobiledevice
# Linux: apt install libimobiledevice-utils
idevicebackup2 backup --full ~/iphone-backup/

Step 2 — Reconstruct the directory tree with unwrap-ios

The backup directory contains thousands of files named by their SHA-1 hash, plus three index files:

~/iphone-backup/<UUID>/
├── Info.plist           # device info, OS version
├── Manifest.db          # SQLite mapping hash → original path
├── Manifest.plist       # version + encryption settings
├── Status.plist
├── 0/
│   ├── 0a1b2c3d…fe     # actual file contents (binary)
│   └── …
├── 1/
└── …

NullVeil can reconstruct the original directory structure using unwrap-ios:

nullveil unwrap-ios ~/iphone-backup/<UUID>/ --out /tmp/ios-unwrapped/
# Copied  : 4821 file(s)
# Missing : 0 (in Manifest.db but absent from backup)
# Skipped : 3 (malformed entries)
# Manifest: ~/iphone-backup/<UUID>/Manifest.db

The output directory mirrors the on-device structure:

/tmp/ios-unwrapped/
  CameraRollDomain/
    Media/
      DCIM/
        100APPLE/
          IMG_0123.HEIC
          IMG_0124.MOV
  HomeDomain/
    Library/
      SMS/
        sms.db
  AppDomain-com.example.app/
    Documents/
      cache.db

Step 3 — Carve from the unwrapped directory

With the files now in a navigable structure, run NullVeil over them:

# Carve any additional images/videos embedded inside binary files
nullveil carve /tmp/ios-unwrapped/CameraRollDomain/ \
    --out /tmp/ios-carved/ \
    --types jpg,heic,png,mov,mp4

# Recover deleted SQLite rows from a database file (using external tools)
# NullVeil extracts the .db; then use iLeapp, APOLLO, or sqliteparse on it.

Step 4 — What NullVeil can and cannot do here

Task Can NullVeil help?
Reconstruct directory tree from backup Yes — unwrap-ios reads Manifest.db
Decrypt an encrypted iTunes backup No — use iphone-backup-decrypt first
Recover deleted iMessages Yes, indirectly — extract sms.db with unwrap-ios, then use SQLite-undelete tools
Recover deleted photos Maybe — if the photo was in the last backup, it's there; otherwise no
Recover from a fresh deletion (no recent backup) No — non-jailbroken iOS doesn't expose the raw blocks

iTunes/Finder backups capture the state of the phone at backup time. There's no concept of "deleted entries" inside a backup — it's just a flat directory of files.

For the SQLite-level recoveries (Messages, Contacts, Notes), tools like iLeapp and Sqlite Forensic Explorer specialise in parsing iOS backups specifically. NullVeil's job ends at giving you the raw sms.db/Photos.sqlite file.

Step 4 — Extract specific files

A small helper script to extract a file by its iOS path:

#!/usr/bin/env bash
# extract.sh: pull a file by its iOS path out of an iTunes backup
BACKUP="$1"
IOSPATH="$2"
HASH=$(sqlite3 "$BACKUP/Manifest.db" \
    "SELECT fileID FROM Files WHERE relativePath = '$IOSPATH' LIMIT 1")
cp "$BACKUP/${HASH:0:2}/$HASH" "./$(basename "$IOSPATH")"
./extract.sh ~/iphone-backup/<UUID> Library/SMS/sms.db
# → sms.db now lives in cwd

What NullVeil could do better here

We're being honest in the docs because we're being honest in the code:

  • iTunes Backup parser — a future NullVeil feature could read Manifest.db and expose the backup as a virtual filesystem with the original iOS paths. Not in the tool today.
  • APFS prior-state walking — APFS snapshots and Time Machine contain prior states of the volume. NullVeil parses APFS containers but not the snapshot tree. Also future work.
  • iOS Photos.sqlite / Messages.sqlite parsers — these are dialects of SQLite with iOS-specific schemas. Out of scope for NullVeil.

If you're building a serious iOS forensics workflow, NullVeil is one tool among several. Use it for what it's good at (raw-bytes work on jailbroken images, carving photo/video signatures), and pair it with iOS-specialist tools for the rest.

What next