Input Output + Syslog (iO+S): Obtaining Data From Locked iOS Devices via Live Monitoring
summary
Demonstrates recovering rich forensic data from locked iOS devices by monitoring USB traffic and live sysdiagnose output, using usbpcap, libimobiledevice, iDeviceRecovery and a newly released io+s toolkit. Shows 19 USB endpoints on an iPhone X and ~60 commands inside a sysdiagnose capture, and extracts photo filenames and locations, Safari history, AirDrop logs, SSID/BSSID with lat/long and rotating MACs, plus partial iCloud emails — even from AFU/diagnostics or unpaired devices unless USB Restricted Mode blocks access.
AI-written summary · about
chapters (13)
- 0:00iO+S research introduction
- 1:07iOS forensics limitations
- 3:31iOS device states and modes
- 7:03Volatile data and CIS logs
- 12:01CIS logs from locked devices
- 15:09USB endpoints forensic potential
- 19:45USB restricted mode and pairing
- 23:40Recovery mode extraction
- 24:42Data recovery paired vs unpaired
- 25:25Forensic findings modern devices
- 31:51Future research and fuzzing
- 32:55Key takeaways and tool release
- 34:21Q&A
related talks
58mUncovering OWASP’s Mobile Risks in iOS Apps
40mAll Your Apple are Belong to Us: Unique Identification and Cross-Device Tracking of Apple Devices
40mIntroduction into Reverse Engineering and iOS Security
47mBASHing iOS Applications
46miOS Trustjacking: Trust Has a Price
26mIn Depth Review of SailfishOS Forensic Artifacts
31mWe All Know What You Did Last Summer
32mA Case Study of MacOS Supply Chain Compromise