-
Book Overview & Buying
-
Table Of Contents
-
Feedback & Rating
Mastering Mobile Forensics
By :
All iDevices use a type of non-volatile memory chip using NOT AND gates called NAND memory, this memory in iDevices is divided into two partitions: system and data. As suggested by their respective names, the system partition holds the firmware including the operating system and built-in applications and in general it's a read-only partition. Depending on models, this partition can range anywhere from 1 to 2.5 GB. In general this partition does not hold any forensically interesting evidence; however, it's important to note that the /private/etc/passwd path holds the preconfigured user's "mobile" and "root" passwords, as shown in following screenshot:

System partition of iOS 9.0
If you open the file with a text editor you should get the following:

Default password of users root and mobile
The plaintext password is alpine and is the same in all iDevices. This password cannot be modified unless the device is jailbroken.
Data partition...
Change the font size
Change margin width
Change background colour