User`s Manual
Contents
1. Device model Product Version 22 Build Version BG 77 Model Number MATI2LL Serial Number 757 30HDUWHE iPhone Multimedia data includes Graphics category This data is displayed as thumbnails You can click a file to view it The image opens in the same pane If necessary for big images it scales to fit the window size To return to thumbnails click the scaled image You can also use external viewers to view multimedia data To open the image in the external viewer right click on it and select Open with arapen 0 corporation RECOVERY GR Paraben s iRecovery Stick for APPLE iPHONE 4 IRECOVERY for APPLE iPHONE 3 Main Page Search Text Acquired Data Messages Contacts Call Hi 9 ad Graphic data in the form Graphics data of thumbnails Organizer 5 Internet Data Recovered Data Other Data 33 Items Data Acquired From Properties La Bookmarks Q Search Results Name Program timestamp 07 07 2010 16 55 29 Manufacturer Apple ji Device model iPhone Product Version 22 Build version 5677 Model Number M 1Z2LL IA Serial Number 75730HDUWHB iR Paraben s iRecovery Stick Paraben s iIRECOVERY for APPLE iPHONE mail Scaled image Acquired Data Messages Contacts Call History Graphics Organizer Internet Data Recovered Data Other Data Data categories 33 Ite2. Contacts 07 05 2010 14 55 04 Ann 07 05 2010 14 55 21 Ben Messages 07 05 2010 14 55 38 Sara 07 05 2010 14 55 59 John 07 05 2010 14 56 16 Lora Call History Palmer Organizer Graphics Data pane Internet Data Recovered Data aw XG li lt lt 0 Other Data Data Categories pane Device model Data Acquired From Properties Y Bookmarks Search Results Name Program timestamp 05 07 2010 18 44 06 Manufacturer Apple Device model iPhone Details pane Product Version 2 2 Properties Build Version 5G Model Number MAF IZLLIA Serial Number 757 30HDUWHS 8 8 en corporation Paraben s IRECOVERY STIC for APPLE iPHONE Main Menu File Menu The File Menu contains basic file options for working with iRecovery Stick Open Opens a saved workspace Workspace Saves the open workspace under a different name can select a device to scan Starts the import of iPhone backup files Exports the content of the workspace as an MS Excel xIs file Shuts the iRecovery Stick down View Menu The View menu lets you display tools in the iRecovery Stick user interface Description Opens the Bookmarks pane Tools Menu The Tools menu lets you check for iRecovery Stick updates and define logging and folder options Menu Rem Options Lets you define logging options and the defa
3. RECOVERY STICK for APPLE iPHONE iRecovery Stick Options To define iRecovery Stick options select Tools Options iRecovery Stick options are the following 0 Logs You can define what logs will be created during the recovery process The Plug in logs option creates a text file log of the recovery process based on the plug in activity and the Serial logs option logs all traffic across the communication port If you have any problems with iRecovery Stick send the logs to Paraben o Default Workspace Folder When recovery process starts a new workspace is automatically created in the default workspace folder When you close such a workspace you re proposed to save it under other name If you don t want to save the workspace click No and the workspace will be deleted Make sure that there is enough space on the disk on which the default workspace folder is stored Options 5 Logs Pugin DI Types of logs created during acquisition Serial logs al Default folder for workspaces C Documents and Settings Adrninistrator Cases Browse 0 Default folder for workspaces WV Save Cancel Additional Information and Training Paraben Corporation offers training classes and certifications for professionals seeking to solidify their knowledge of handheld device forensics Coursework trains students on PDAs hybrid devices SIM cards and GPS devices and tests that knowledge with practical examinations using multipl
4. 1s iRecovery Stick User manual RECOVERY STICK for APPLE iPHONE Contents ADOUR GCOC Ce et ee ee 3 fe ao EE E EEEE EEE 4 System 0 0 06 8 4 Application User EE 5 Understanding the User Interface rrrrnrrnrarerrarerranenranrnranennanrnnnnrnnanrnnnnsnnnnsnnnsennnnee 5 EA OAE E 5 0 5 8 4 7 RENN Ne 8 Recovering Data from the iPhone Device rrnnnnnnnennnnnnnnnvnnennnrnnnnnvanennnrnnnnennnennnennnne 8 Recovering Data from iTunes Backup Files rrrnarernnnernnnernnnervnnervnnenvnnennnnennnnennnnee 9 felg Male WR VV OK SD AGC Oers eE E E E 11 FAN 6100 OLE DACE eE E E eee 11 EAN 0 11 Opening an Existing WorkSpace ee 11 Closing a Workspace 0 00 11 Viewing iPhone Data 12 RECON DA 0 12 P 13 EANO D2 tc Coe eee ee nee ne ee 17 Exporting rs ORRE ESS VEERSE 18 BAER Pr 18 BOOKMARK e 19 TSO OKIE S sorser ree anaE EEE EERE EEEE EEEREN EER 19 rave 0 ao 0 19 Editing a BOOKIMANK ON 19 Deleting 2 3 OOK VAG is xxnannatuaconantsnuasentuesancutsaniametannaesssnunianuauexeanataanosamtaauasssaneanebaste 19 TOUDE SOO INO eese neresen OE eE EEEE 20 ENN aeai r E 21 iRecovery 0 22 Additionaliniormalon ANG TRANG 6 22 en corporation RECOVERY STICK for APPLE iPHONE About iRecovery Stick Welcome to Paraben s iRecovery Stick This program allows investigators to recover
5. Bookmarks tab of the Details pane 2 Highlight the bookmark to delete 3 Right click the bookmark and select Delete or from the menu click Manage gt Delete 4 Select Delete All to delete all bookmarks en 19 corporation RECOVERY STICK for APPLE iPHONE Troubleshooting The following section provides answers for some common issues that you may encounter when using iRecovery Stick Problem The recovery process was broken The device is in Recovery mode What do do Solution Start the Recovery from the device once more If you don t want to recover data just wait until the device restarts and disconnect it from the computer Problem The iPhone hung What do do Solution Reset the iPhone by holding the sleep wake button at the top right of the device and the home button at the bottom center of the face at the same time Problem The iPhone doesn t connect to the computer What to do Solution Please try one of the following e The iPhone battery might need to be recharged e f that doesn t work disconnect other USB devices from your computer and connect the iPhone to a different USB 2 0 port on your computer e If that doesn t work turn the iPhone off and turn on again Press and hold the Sleep Wake button on the top of the iPhone for a few seconds until a red slider appears and then slide the slider Then press and hold the Sleep Wake button until the Apple logo appears e If that doesn t w
6. data from iPhones including text messages and more The data can be recovered either from the iPhone device directly or from the IPhone back up files All iPhone OS are supported including iPhones 1 x 4 x en corporation RECOVERY STICK for APPLE iPHONE Getting Started System Requirements The following requirements must be met to use iRecovery Stick e iRecovery Stick requires a Windows XP or newer operating system e To use the Export to Excel feature Microsoft Excel must be installed on your computer and you must add the Net Framework programming tools during the installation process corporation RECOVERY STICK for APPLE iPHONE Application User Interface Understanding the User Interface The iRecovery Stick interface includes the following parts o The Main page This page contains information about iRecovery Stick and three buttons that let you open the existing workspace start recovery process from the iPhone device or iTunes backup files o The Data page On this page the recovered data and other backup data received from the device is displayed 0 The Main menu The menu provides access to the main functionality of Paraben s iRecovery Stick Main Page The Main page of iRecovery Stick opens at the program start up contains the following elements o A tool bar o Short description of iRecovery Stick o Three icons Start Recovery Open Workspace and Start Import fro
7. ata from the iPhone 1 Do one of the following e Click Start Recovery on the Main page e Click File gt Start Recovery e Press F5 2 Click on the image of the device you want to scan If multiple devices are connected to your computer multiple images are displayed 3 The recovery process starts NOTE If your device doesn t appear in the list in several seconds after the connection try to disconnect it and then connect back again 8 8 corporation RECOVERY STICK for APPLE iPHONE iR Paraben s iRecovery Stick lt iREcover BANLE for appLe ipHone G Main Page Choose connected device Detected Devices If your device is not displayed wait a bit and then try to reconnect it Detected devices Click on the device to start acquisition Click on the device image to proceed Cancel Recovering Data from iTunes Backup Files The iRecovery Stick imports data from the iPhone backup files created by iTunes and recovers deleted data stored in them To import the backup file 1 Do one of the following e Click File gt Start Import e On the Main page click the Start Import from iTunes Backup icon 2 Choose the plug in for importing 3 Navigate to the Manifest plist file then click Open 8 9 corporation iRECOVER for APPLE iPHONE sg araben s iRecc Choose plugin to import Supported plugins iPhone 1 x 2 x Select the correct version of th
8. e iPhone Click on the required icon Info plist Desktop E Status plist Selected backup file My Documents File name Manifest plist Cid d d E n corporation 10 RECOVERY STICK for APPLE iPHONE Working with Workspaces About Workspaces A workspace is a file with a ds extension that contains information recovered from a single iPhone device Creating a New Workspace When you start data recovery iRecovery Stick creates a new temporary workspace The workspace is named Workspace lt number gt ds By default the workspace is saved in the current Windows user folder The workspace is also updated after you create a bookmark You can change the default location where a workspace is saved and you can use the Save As function to relocate and rename a saved workspace To create a workspace 1 Start the data recovery process See Recovering Data from iPhone 2 Click File gt Save As then click Save To define the default workspace folder 1 Click Tools gt Options then type the new name and browse to the folder you want to use 2 Click Save To change the name of a workspace 1 Open the workspace that you want to change 2 Click File gt Save As 3 Browse to the location where you want to save the workspace then type the new name Opening an Existing Workspace Workspaces created by iRecovery Stick ds files can be opened from the user interface 1 To open an e
9. e tools A Paraben Certified Mobile Examiner PCME is prepared for whatever the world of handheld forensics throws at them For more information on these training classes or other Paraben forensic tools please visit www paraben forensics com en 22 corporation iRECOVERY for APPLE iPHONE corporation 23
10. ery Stick ag IRECOVERY for APPLE iPHONE O MO gt gt main Pa ge Acquired Data Text data sub categories tabs Text data a day Calendar ID 1 Description i End date Start date di Start timezone tegories No 07 20 2010 16 00 00 Test event III 07 20 2010 15 00 00 US Pacific Search Text Q Location Summary New event Messages Contacts Call History Graphics Organizer Internet Data 07 20 2010 17 00 00 07 20 2010 16 00 00 US Pacific 5 ky PV Smile 07 22 2010 16 00 00 07 22 2010 15 00 00 US Pacific Love US Pacific 07 28 2010 16 00 00 07 18 2010 13 00 00 07 28 2010 15 00 00 US Pacific 07 18 2010 12 00 00 Cool event Qwerty 07 23 2010 18 00 00 07 23 2010 17 00 00 US Pacific Ann birthday 07 26 2010 18 00 00 07 26 2010 17 00 00 US Pacific Going to New York 07 03 2010 18 00 00 07 03 2010 17 00 00 US Pacific Buy flowers 07 05 2010 18 00 00 07 05 2010 17 00 00 US Pacific New Event 1 1 4 4 4 4 Buy dress 07 31 2010 18 00 00 07 31 2010 17 00 00 US Pacific Go shopping Recovered data Text data in 3 grid form D amp r x E Other Data e i Data Acquired From A Properties Y Bookmarks A Search Results Name 07 07 2010 16 55 29 Manufacturer Apple Program timestamp
11. fuudu ufoxydduckxydozlsslozisyzodososidodosod Contacts 7 Recovered data in the form eventDorsukdhsDusoddtsrydyduduux amp 6 Call History of thumbnails Graphics Records 2 Organizer Internet Data Recovered Data Other Data x Recovered Data category Records 1 Available encodings Data Acquired From A Properties 4 Bookmarks A Search Results Name Program timestamp 07 07 2010 16 55 29 Manufacturer Apple Device model iPhone Product Version 2 Build Version 5677 Model Number MA 1ZLL A Serial Number 75730HDUWH amp Other Data Other data received from the iPhone backup includes the following parts 6 Device properties The properties of the iPhone from which data was recovered are displayed in the Properties tab of the Details pane Click View Details to open the details pane o Data categories In the left of the Data page the categories of the back up data are displayed Click the category name to view its contents o Back up data Acquired backup data is displayed in the right part of the Data page Data representation depends on its format arapen i corporation RECOVERY STICK for APPLE iPHONE iR Paraben s iRecovery Stick BAX RECOVERY 1 81646 for apple iphone M 3 Main Page Data page Acquired Data Address Book Creation date Department Display Name First name First Fonetic Job title Last name Middle fo
12. m iTunes Backup 6 Alink to the Data page if there is any data in the workspace From the Main page you can do the following o Start recovery process from the iPhone device or iTunes backup files Define program options Open an existing workspace Move to the Data page Rename the currently opened workspace Export workspace data to Excel Oo O Data Page The Data page opens when data recovery process finishes you open a workspace or you click the Back to Data link on the Main page The Data page contains the following elements A list of data categories The Data pane in which data is displayed The name of the device from which data was recovered A Search field The Details pane including the Properties tab the Bookmarks tab and the search Results tab 0 A link to the Main page en corporation OO O O RECOVERY for APPLE iPHONE From the Data page you can do the following o View the recovered data View the properties of the device from which you recovered data Search text data in the workspace Create and access bookmarks Define program options Open an existing workspace Go to the Main page Save the open workspace using a different name Export workspace data to Excel OO G O O O O 0O iR Paraben s iRecovery Stick Job Parahen s Main menu File Tools IRECOVERY for APPLE iPHONE gt gt main Page Link to Main page Search field Search Text Q Acquired Data address book
13. ms FEN i Properties Ca Bookmarks Q Search Results Data Acquired From Name Program timestamp 07 07 2010 16 55 29 Manufacturer Apple Device model Phone Product Version 2 2 Build Version 5677 Model Number 712 rial Number 757 30HDUWH amp corporation iRECOVERY for APPLE iPHONE Searching Data The iRecovery Stick allows you to search for text data in a workspace To search text data 1 On the Data page in the Search Text field in the upper right corner of the page type the search string text 2 Click Search or press Enter 3 The search progress is displayed in the Search Results tab of the Details pane Click Abort to stop the search 4 When the search finishes the search results are displayed in the Search Results tab of the Details pane Each result is displayed as lt Category name gt lt Sub category tab name gt 5 Double click the search result to navigate to It iR Paraben s iRecovery Stick lt gt gt main Page Search text field Acquired Data Calendar Notes P All day L Calendar ID EE End date Location Start date Start timezone Summary Summary US Pacific New event g Messages o 07 712 20 2 2010 17 00 00 US Pac ific Contacts Call History Graphics Hh Organizer Recovered Data Internet Data x j Other Data Data Acquired From 8 d en corpora
14. netic Middle name Midc 07 05 2010 14 55 04 Ann Contacts 07 05 2010 14 55 21 Ben 07 05 2010 14 55 38 Sara Messages 07 05 2010 14 55 59 John 11339393 Call History 07 05 2010 14 56 16 Lora Salor Palmer Se 2 rganizer Acquired data Graphics Internet Data Recovered Data 5 D 6 d Xx 3 Other Data Data categories Pevice model Data Acquired From Properties Y Bookmarks Search Results Name Program timestamp Device 05 07 2010 18 44 06 Manufacturer prope rties Apple Device model iPhone Product Version 22 Build Version 5677 Model Number MATIZLL AA Serial Number 757 30HDUWHS Text data includes the following categories o Contacts The device phonebook Messages The device SMS messages Call History The device call logs Organizer The device calendar memos and 50 on Internet Data Includes Safari suspend state Safari Bookmarks Safari History Cookies Delivery Accounts Mail Accounts and Youtube bookmarks o Other Data This data includes Properties Maps Directions Maps Bookmarks Maps History and Dynamic Text O 09 Data from each category is displayed in a grid to the right of the Data page There can be several tabs in the grid if data contains sub categories such as a Calendar and Notes for the Organizer arapen corporation RECOVERY for APPLE iPHONE iR Paraben s iRecov
15. ork restart your computer and reconnect the iPhone to your computer e If that doesn t work download and install or reinstall the latest version of iTunes from www apple com itunes en 20 corporation RECOVERY STICK for APPLE iPHONE Creating Log Files IRecovery Stick has three options for logging support built right in e The Plug in Log option creates a text file log of the recovery based on the plug in activity e The Serial Log option logs all traffic across the communication port e The GUI Log option logs all events that happened in the iRecovery Stick interface during one program session Logs contain useful information for resolving issues and adding support for new models The GUI Log is created automatically and rewritten each time when iRecovery Stick is restarted The Plug in Log and the Serial Log are optional The best practice is to leave these logging options turned off unless you encounter 8 problem Then enable both logging options and duplicate the problem These logs may be needed if you call tech support to assist you To enable the Plug in Log and the Serial Log creating 1 Click Tools gt Options 2 Check Serial Logs Plugin Logs or both 3 Click Save NOTE All logs are created in the user folder by default C Documents and Settings user name logs The Plug in Log and the Serial Log are overwritten when a new recovery process is performed using the same plug in 21 corporation
16. readsheet document Select the folder to which data will be exported and click on the Export button bo start exporting Destination file xls Choose destination file en Browse F Open file after generation Start Export port Cancel k corporation RECOVERY STICK for APPLE iPHONE Bookmarks A Bookmark is a pointer to data stored in the workspace Bookmarks include the following information o Item the name of the first cell of the row to which the bookmark is pointing o Name the name of the bookmark o Details the description of the bookmark Accessing Bookmarks Bookmarks are displayed in the Bookmarks tab of the Details pane To view bookmarks 1 Do one of the following o Click View gt Bookmarks o On the Data page click View Details in the bottom left corner 2 To view the data to which bookmark is pointing double click the bookmark Adding a Bookmark To add a bookmark 1 Select data to be bookmarked it can be either a cell of the grid or a row 2 Right click the item and select Add to Bookmarks 3 Type 8 name and 8 description for the bookmark and then click Save Editing a Bookmark To edit a bookmark 1 Open the Bookmarks tab of the Details pane 2 Right click the bookmark and click Edit or from the menu click Manage gt Edit 3 Edit the bookmark name and description and then click Save Deleting a Bookmark To delete a bookmark 1 Open the
17. tion D 07 22 2010 16 00 00 07 22 2010 15 00 00 US Pacific aaa p o 07 28 2010 16 00 00 07 28 2010 15 00 00 US Pacific Cool event on 07 18 2010 13 00 00 07 18 2010 12 00 00 US Pacific Qwerty 07 23 2010 18 00 00 07 23 2010 17 00 00 US Pacific Ann birthday 07 26 2010 18 00 00 07 26 2010 17 00 00 US Pacific Going to New York 07 03 2010 18 00 00 07 03 2010 17 00 00 US Pacific Buy Flowers o 07 05 2010 18 00 00 07 05 2010 17 00 00 US Pacific New Event Found result Properties Search completed 4 items found alder 07 31 2010 18 00 00 07 31 2010 17 00 00 US Pacific Go shopping Qa Search Results Search Results tab H Organizer Calendar dress 2 Other Data Properties 3 Other Data Properties 4 Other Data Dynamic Text 17 RECOVERY for APPLE iPHONE Exporting Data Exporting Data to MS Excel You can export data from the workspace as an Excel workbook 5 file To export data 1 Click File gt Export to Excel 2 Click Browse to navigate to the destination folder and name the exported file 3 Check Open file after generation to open the exported file 4 Click Export q Export to Excel Welcome to Recovery Stick Export to Excel wizard This wizard allows you to export all data from the case to the Microsoft Excel sp
18. ult folder for saved oe Check for Connects to the Paraben s site to download updates Updates Help Menu The Help menu gives access to this help file information about the iRecovery Stick application and displays registration data Description Opens iRecovery Stick user documentation About Qt Provides data about the Qt tool licensed for use in iRecovery Stick Displays the iRecovery Stick description and the version number en corporation RECOVERY STICK for APPLE iPHONE Recovering Data iRecovery Stick allows you to recover data either from iPhone device or from iPhone back up CAUTION iRecovery Stick places recovered data in a temporary workspace that is automatically created in the workspace folder The folder location is defined in the Options menu and has a Workspace lt number gt ds name When you close the workspace you must save it or you will lose the data Recovering Data from the iPhone Device The iRecovery Stick acquires data and recovers the deleted data from iPhone devices This section explains how to recover data from your iPhone Before the recovery process starts do the following 1 Turn on the device 2 Ensure that the device battery is completely charged 3 Ensure that iTunes drivers are installed on your computer Its installation is performed automatically at the first iIRecovery Stick connection 4 Connect the iPhone to the computer with a data cable To recover d
19. xisting workspace do one of the following o On the Main page click on the Open Workspace button o Inthe File menu select the Open Workspace item o Press Ctrl O When you open a new workspace the currently open workspace closes Unsaved information is lost Closing a Workspace The workspace closes when any other workspace opens or iRecovery Stick shuts down en 11 corporation RECOVERY STICK for APPLE iPHONE Viewing iPhone Data The iRecovery Stick receives two types of data from the iPhone device or iPhone backup e Recovered deleted data e Other backup data Recovered Data iRecovery Stick recovers the following types of data e Address Book records e Address Book images e Calendar records e Call History records e Notes e SMS To view the recovered data select the Recovered Data category The recovered data is displayed in records and is not parsed The list of records is displayed in the Data pane You can click on a recovered record to view its contents The record opens in not parsed format in the File viewer to the right of the Data pane To change the code page for the opened record select the required encoding in the drop down list To close the File viewer for the record click Close en 12 corporation iRECOVERY for APPLE iPHONE iR Paraben s Recovery Stick lt iRECOVERY forAPPLE iPHONE O O Q main Page Acquired Data Messages duxjrsidisidisi
Download Pdf Manuals
Related Search