<Thread> It’s 5:30am and I’m at the airport. Few days ago, M. X called me. He is the CEO of a big company and he thinks that one of his competitors hacked his phone. I’m going to the company HQ to analyse his phone and evaluate the situation. 
This is my first post-lockdown flight. Even if the lockdown ended a while ago and the situation is under control in France, the majority of flights are still cancelled and the airport is empty. We are in the middle of the summer holidays, it should be full of people in theory.
Obviously, this is not my final destination. I’m not that stupid 😅
I’m on site. The fun can start!
Let see what this phone has to tell me
Thanks to the awesome @ElcomSoft iOS Forensic kit, I have now an image of the phone with all the data elcomsoft.fr/eift.html
The phone has more than 41000 location data points saved. You should really turn off your location people
I used APOLLO to analyse the data and generate kmz files github.com/mac4n6/APOLLO
Once you have the kmz files, you can use Google Earth Pro to open it.
Yes, iOS has a dedicated database to keep the history of where you parked your vehicule...
Yes, iOS has a dedicated database to keep the history of where you parked your vehicule...
Thanks to @ElcomSoft Phone Viewer, you can view the Wifi history with the location. So, now I know where he went for holidays since he bought his phone. I also know where he bought his phone because the phone was connected to the store Wifi.
Worth to say:
- Turn off your wifi if you don't need it
- Clear regularly the Wifi history in your phone
- Turn off your wifi if you don't need it
- Clear regularly the Wifi history in your phone
You should clear regularly your web history too #JustSaying
The level of details is insane you have a log to know when the torch has ben used
The previous screenshot is coming from the report generated by the very good iLEAPP made by @AlexisBrignoni github.com/abrignoni/iLEA…
I'm back from lunch. It's time to look at the keychain baby
This is weird. When he opened Safari and used the search bar, the search is made on google.ch. He never went in Switzerland and he doesn't have a Google account at all. Someone has an explanation? 🤔
This is the end of the job. I did a meeting with the CEO to show him the results and share my conclusions.
This exercice is really interesting but damn this is scary. In less than 1 hour, I was able to say where he lives, where he works, where he bought the phone, the name of the Clud Med he went 3 years ago, the conference he went in the US for work, etc
You have no idea how deep your phone knows you
I don’t think someone hacked him. It was a false alarm
Some digital forensic experts started to follow me after this thread. I’m not a forensic expert at all, so if I wrote stupid things don’t hesitate to tell me, if you have tips I take them too!
Back in Toulouse!
