1/13/2024 0 Comments AutoMounter for ipod instal![]() My approach to determining the victim's real name is to search the unallocated portions of the partition for the tag "name" followed immediately by an alphanumeric character (alphanumeric in the event that I'm incorrect in the assumption that the music purchaser's name coming from the iTunes credit card-verified account). ![]() The name's source looks to be the account information from registering with iTunes (which requires credit card payment), but I have not confirmed this. m4p songs from iTunes, including email address of the purchaser AND the first and last name. ![]() A little hexeditor fun helped me determine that there is quite a bit of information embedded in the. If the iPod is stolen and the owner data has been changed by theif, then you don't have the victim's username, but instead the suspect's.ĭetermining the victim's real name/email addressĪ little "googling" led me to understand that iTunes purchased music contains the purchaser's email address embedded in the song to help Apple track music pirates.Cheese, well you don't have much of a clue as to who the person is. You can see this with the SleuthKit's mmls command using something like: In an Ubuntu Linux system (properly configured to not automount), the user name is displayed in the Disk Mounter applet or in Nautilus as " User's iPod" where User is the volume name of the data partition on the iPod. Neither effort is forensically sound, however, and changes to the stored data can/will occur. Turning on the device and navigating the menu system will do the same. One of the first things I discovered in trying to identify the current owner is that the iPod can be plugged into a Windows or Mac computer with iTunes installed, and iTunes will reveal the user name. I do know from experience that depending on the generation of the device, the file system can by fat32 or hfs+. I don't own one myself, so I don't know much about their internal functioning. IPods are obviously small, portable devices that are easily stolen. I've been asked to attempt to identify the previous owners of suspected stolen devices. I have gone from years of computer forensics without ever encountering Apple Products in any meaningful way to seeming only dealing with Apple laptops and iPods.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |