\n
![](\"https:\/\/images.squarespace-cdn.com\/content\/v1\/53836afce4b0ea0513df946a\/1616377956605-ECW84RYVES4YP1MOH7PR\/giphy.gif?format=1500w\")
<\/p>\n
\n<\/p>\n
This guide will help you setup your iDevice with two binaries that can greatly assist with targeted testing and analysis.\u00a0 My goal is to equip you to do your own research and testing to confidently answer the questions you will surely have as you learn this beautiful dance we call DFIR.\u00a0 If you currently rely on a commercial tool to extract your iDevice data and then parse the data for you, that is totally normal and this article is absolutely for YOU!\u00a0 Years ago, @iamevltwin<\/a> broke my thought process on how to address mobile devices.\u00a0 My training and education up to that point was great, and I knew a LOT about mobile devices and strategies for finding the evidence I was looking for.\u00a0 But\u2026.I relied on data extraction methods by commercial tools and mostly parsing by commercial tools as well.\u00a0 While that is acceptable and perfectly fine to do, it can be very time consuming.\u00a0 Trust me when I say, if @iamevltwin<\/a> asked me a question, and my response was \u201cI\u2019ll let you know in a few hours\u201d\u2026she would probably throw a steak and cheese egg roll at my head. [*Editors Note: I would never waste a delicious steak and cheese egg roll, instead I would deeply judge and give him the side eye.\u2014S]\u00a0 So for the sake of never wanting to waste a good egg roll, I learned how to target just the data I want and address it in a very specific way. \u00a0<\/p>\n To summarize what we are about to do:<\/p>\n 1. Install and run \u201cfsmon\u201d and \u201ccda\u201d binaries that already have proper entitlements, so you don\u2019t have to make the files.<\/p>\n<\/li>\n 2. Very basically learn what they do and how to run them.<\/p>\n<\/li>\n 3. Use them to target a specific piece of data on the iPhone.<\/p>\n<\/li>\n 4. Extract that specific piece of data to my desktop so I can \u201cGET SHIT DONE\u201d\u00a0<\/p>\n<\/li>\n<\/ol>\n **If you are reading this, please make sure you have read and followed the instructions for <\/em>Part 1 <\/em><\/a>and <\/em>Part 2 <\/em><\/a>.\u00a0 If you are jumping in here and trying to follow along, I assume your Mac and iDevice are the same as mine from the end of Part 2.\u00a0 It is strongly advised that you do this on a secondary, test \/ research device and not your primary use device.\u00a0 Nothing we are doing here should break anything, but things happen when you are in a root shell into your device and you have been warned!.**<\/em><\/p>\n I have both binaries you will need already made and entitled, trying to make this process as easy as possible to get you setup for testing!\u00a0 The link below will take you to a .zip file containing \u2018cda\u2019 and \u2018fsmon\u2019, which are both Mach-O 64-bit ARM executables. \u00a0<\/p>\n The \u2018cda\u2019 binary helps locate where an app is storing it\u2019s data! iOS stores most app data behind randomly generated GUID\u2019s in the file system, so finding where a certain app is storing its user data can be a real pain.\u00a0 This binary makes quick work of telling us exactly the directories we need to pay attention to, and does so in seconds.<\/p>\n The \u2018fsmon\u2019 binary is a file system monitor.\u00a0 Plain and simple, it prints to your screen the changes occurring in the file system.\u00a0 For research purposes, this is priceless.\u00a0 If you need to know what happens when you take a photo, send an SMS, install an app, etc. you can run \u2018fsmon\u2019 while pressing the buttons on your device and watch your screen light up with what changed!<\/p>\n\n
Download iOS Binaries<\/h2>\n