meat's Introduction

M.E.A.T. - Mobile Evidence Acquisition Toolkit

Meet M.E.A.T!

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices (and Android in the future).

Requirements to run from source

Windows or Linux
Python 3.7.4 or 3.7.2
Pip packages seen in requirements.txt

Types of Acquisitions Supported

iOS Devices

Logical

Using the logical acquisition flag on MEAT will instruct the tool to extract files and folders accessible through AFC on jailed devices. The specific folder that allows access is: \private\var\mobile\Media, which includes fodlers such as:

AirFair
Books
DCIM
Downloads
general_storage
iTunes_Control
MediaAnalysis
PhotoData
Photos
PublicStaging
Purchases
Recordings

Filesystem

iOS Device Prerequisites

Jailbroken iOS Device
AFC2 Installed via Cydia

Using the filesystem acquisition flag on MEAT will instruct the tool to start the AFC2 service and copy all files and fodlers back to the host machine.

This method requires the device to be jailbroken with the following package installed:

Apple File Conduit 2

This method can also be changed by the user using the -filesystemPath flag to instruct MEAT to only extract up a specified folder, useful if you're doing app analysis and only want the app data.

MEAT Help

usage: MEAT.py [-h] [-iOS] [-filesystem] [-filesystemPath FILESYSTEMPATH]
               [-logical] [-md5] [-sha1] -o OUTPUTDIR [-v]

MEAT - Mobile Evidence Acquisition Toolkit

optional arguments:
  -h, --help            show this help message and exit
  -iOS                  Perform Acquisition on iOS Device
  -filesystem           Perform Filesystem Acquisition - 
  -filesystemPath FILESYSTEMPATH
                        Path on target device to acquire. Only use with --filesystem argument
                        Default will be "/"
  -logical              Perform Logical Acquisition
                        iOS - Uses AFC to gain access to jailed content
  -md5                  Hash pulled files with the MD5 Algorithm. Outputs to Hash_Table.csv
  -sha1                 Hash pulled files with the SHA-1 Algorithm. Outputs to Hash_Table.csv
  -o OUTPUTDIR          Directory to store results
  -v                    increase output verbosity

Devices tested on

iPhone X iOS 13.3 iPhone XS iOS 12.4

Known issues

Folder timestamp preservation
Can't preserve birth time of files on Linux only
iOS 9 bugs - Don't have device so can't test directly

Things to do in the future - Ranked

Add post processors
Add ability to containerize - ZIP, TAR, AFF4
- I tried to containerize while processing, but zipfile and tar don't allow me to keep appending blocks to individual files
Add keyword searching while processing or after
Add hash matching while processing or after
Add Android support (Some code can already do this, but I don't have a device to test on)
Add ability for the user to specify block device for android physical acquisitions
Add support for iTunes backups
Add MacOS support (message me if you want this!)

Special Thanks

BlackStone Discovery
pymobiledevice
Mathieu Renard for fixing the iOS 13 bug
Thanks W.E.

meat's People

Contributors

Stargazers

Watchers

meat's Issues

Logical acquisition fails on Ubuntu 18.04

The serial number in pymobiledevice2/usbmux/usbmux.py is returned as a byte array so string split fails with a stack dump. The following patch fixes it for me but may break other platforms. It is probable that checking the returned type of serial and doing the decode if it is a byte array is the correct fix.

diff --git a/pymobiledevice2/usbmux/usbmux.py b/pymobiledevice2/usbmux/usbmux.py
index 2b0741f..707c18c 100644
--- a/pymobiledevice2/usbmux/usbmux.py
+++ b/pymobiledevice2/usbmux/usbmux.py
@@ -108,7 +108,7 @@ class BinaryProtocol(object):
             return {'Number': struct.unpack("I", payload)[0]}
         elif resp == self.TYPE_DEVICE_ADD:
             devid, usbpid, serial, pad, location = struct.unpack("IH256sHI", payload)
-            serial = serial.split("\0")[0]
+            serial = serial.decode("utf-8").split("\0")[0]
             return {'DeviceID': devid,
                     'Properties': {'LocationID': location, 'SerialNumber': serial, 'ProductID': usbpid}}
         elif resp == self.TYPE_DEVICE_REMOVE:

._m2crypto import failed

System:

Microsoft Surface
Windows 10 Pro
Python 3.7.4
All items in requirements.txt installed via pip -r with no problems.

Full file system extraction - Timestamps are updated to extraction time

HI Jack. I used MEAT to perform a full file system extraction on an iPhone 7 Plus. I am using Checkra1n for my JB. I processed the extraction using two commercial tools. It looks like timestamps for certain directories and files are set to the time I extracted the data. For example, directories and files under the Media category have all timestamps set to yesterday, when I did the extraction. Time stamps for records pulled from databases, like KnowledgeC or call logs, are not updated to extraction time. Please let me know what other information I can provide about this issue, to help resolve it.

Recommend Projects

jfarley248 / meat Goto Github PK