# Checkra1n & iOS Forensics

**URL:** <https://community.metaspike.com/t/checkra1n-ios-forensics/107>\
**Category:** Digital Forensics\
**Created:** [December 26, 2019, 5:06pm UTC](https://community.metaspike.com/t/checkra1n-ios-forensics/107 "2019-12-26T17:06:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [December 26, 2019, 5:06pm UTC](https://community.metaspike.com/t/checkra1n-ios-forensics/107/1 "2019-12-26T17:06:44Z")

</div>

It’s an exciting time to be doing iOS forensics! I was reading [Mattia Epifani](https://www.linkedin.com/in/mattiaepifani/)’s blog this morning and I’m looking forward to playing with his updated [ios\_bfu\_triage](https://github.com/RealityNet/ios_bfu_triage) script.

**ios\_bfu\_triage** , in summary, is a script that you can run on MacOS to extract data from a “chekcra1ned” iOS device. The possibilities include collecting device information, executing live commands, and acquiring a full image! Read more here:

> **[Checkra1n Era - Ep 5 - Automating extraction and processing (aka "Merry Xmas!")](https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-5-automating.html)**
>
> DFIR research

Once the acquisition is complete, you can bring the acquired TAR to your mobile forensics tools for parsing, examination, and reporting!

If you are not familiar with Mattia’s work, I would recommend reading all of his posts on the topic. Especially this one:

> **[Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"](https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html)**
>
> DFIR research

Mainstream tools are also adding support for the recent iOS exploits. If you have been acquiring “chekcra1ned” iOS devices, I would be interested to hear your experiences (afu.1.dar anyone?) 😁

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [December 27, 2019, 7:07pm UTC](https://community.metaspike.com/t/checkra1n-ios-forensics/107/2 "2019-12-27T19:07:36Z")

</div>

Another interesting open-source project is iLEAPP by Alexis Brignoni:

> **[abrignoni/iLEAPP](https://github.com/abrignoni/iLEAPP)**
>
> iOS Logs, Events, And Preferences Parser. Contribute to abrignoni/iLEAPP development by creating an account on GitHub.

This is a logs, events, and preferences parser for iOS 11+ written in Python.

You can read more here:

> **[iLEAPP: iOS Logs, Events, And Properties Parser](https://abrignoni.blogspot.com/2019/12/ileapp-ios-logs-events-and-properties.html)**
>
> Introducing a Python 3 scripts that merges all my previous iOS digital forensics and incident response scripts (DFIR) into one. iLEAPP ...