As we mentioned in part one of this blog, there are times when a forensic examiner must locate a Unique Identifier on an iPhone. If the device is protected with a pin or a passcode, and the forensic examiner does not have either the pin/passcode or the computer containing the iPhone’s lockdown file, this task is problematic. Currently, both iTunes and BlackLight do not read information from an attached iPhone device under these circumstances.
This blog illustrates how a forensic examiner can safely find a pin/password protected iPhone serial number (the same one found on the box the device shipped with) using a Windows 7, or Windows Vista virtual machine or workstation.
iPhone Unique Identifiers
An iPhone device is uniquely identified by any of the following:
• Serial Number
• International Mobile Equipment Identity (IMEI)
• Unique Device Identifier (UDID)
A pin or passcode protected iPhone device’s serial number and IMEI do not display on a Mac OS X system. However, a protected (locked) iPhone serial number can be located using the Windows 7 or Windows Vista operating systems.
We tested this method both on a Macintosh OS 10.6.8 (Snow Leopard) machine running Windows 7 virtually via VMWare Fusion 4.0.2, and on Boot Camp partitions with clean Windows 7 and Windows Vista installations. According to our preliminary findings, it appears two conditions must be met for this technique to work successfully:
1 - An examiner should specifically use Windows 7 or Windows Vista (not tested on Windows XP).
2 - iTunes must not be installed on the Windows machine.
3 – If iTunes is installed, uninstall these components via the Windows Control Panel>Programs and Features section:
a – iTunes
b – Apple Mobile Device Support
Locating a Locked iPhone Serial Number Using a Machine Running Windows 7
Connect the iPhone to the analysis machine using an iPhone USB cable. If possible, use the original Apple cable or the same Apple cable type that shipped with the device.
Select the Windows [Start] menu and select [Computer] to open the ‘(My) Computer’ window.
On the left side of the ‘Computer’ window, select the disclosure triangle next to ‘Computer.’ Right- or Control-click on ‘Apple iPhone’ and select [Properties] from the drop-down contextual menu.
The ‘Apple iPhone Properties’ window opens and the iPhone device serial number displays.
This concludes our two-part ‘Locating a Unique Identifier on a Pin/Passcode Protected iPhone’ blog series.