Tweet
can OS Forensics aquire an image of mobile phone OSs if they are connected?
If not, is this on the road map?
If not, is this on the road map?
-
-
It is a broad question, as there are 1000s of different model phones our there.
The general answer is no.
In V1.2 of OSForensics you can investigate images from common phones as support for the HFS and EXT files systems are included in OSF. Support for SQLite is also included and SQLite usage is common on phones OSs.. But you'll need to acquire the image using some other method or 3rd party software.
In a small number of cases imaging of a phone might be possible in OSF, but only when the phone mounts itself as a mass storage device. (Which doesn't happen by default for iPhones, etc..)
We looked at implementing support for phone imaging (and iPad imaging) imaging, but there is no single method that works on all devices and the rate at which new devices are released also makes support problematic. For example methods that worked on the iPad1 no longer work on the iPad3. In some cases it is near impossible to get an image without making changes to the device or 'jail breaking' it.
Comment