Hello everyone,
is it possible to take an image of my iPhone with the Sleuth Kit? Unfortunately, I have forgotten my iPhone PIN and would like to back up my data.
Thank you!
Without the pin, all the data is encrypted. I do not know if Autopsy can do a back up, but there are plenty of third party tools, including iTunes, that can create a backup.
Unfortunately, without the pin you won’t be able to “trust” the computer you are syncing with…
can i read the memory of my iphone directly without having made a backup beforehand? in other words, can i analyse the memory directly via a usb connection?
No… there is no connection to the phone without the pin. The user partition is encrypted dead on the device, so it won’t decrypt without the passcode. You can’t get access to anything, unless you are using GrayKey or Cellebrite Premium.