Identifying the iPhone Model
2022-5-6 00:48:23 Author: blog.elcomsoft.com(查看原文) 阅读量:37 收藏

A pre-requisite to successful forensic analysis is accurate information about the device being investigated. Knowing the exact model number of the device helps identify the SoC used and the range of available iOS versions, which in turn pre-determines the available acquisition methods. Identifying the iPhone model may not be as obvious as it may seem. In this article, we’ll go through several methods for finding the iPhone model.

The most reliable method

Apple recommends the following way to identify the iPhone model number:

“Go to Settings > General > About. To the right of Model, you’ll see the part number. To see the model number, tap the part number.” (Find the model number of your iPhone, iPad, or iPod touch)

This, indeed, is the most reliable way to find the device model number. The model number printed on the case may not be a fully accurate representation of the actual model number due to potential unauthorized repairs, wear and tear, and cosmetic damage. In some situations, one must pull the SIM tray to see the model ID, which may lead to undesirable consequences.

Identify the iPhone by looking at it

It may or may not be possible to unambiguously determine the iPhone model by its appearance as some models may look very similar while others may have distinctive features. Apple published a series of articles to help identify such models:

This method is the least reliable. You may want to look for a model ID on the case.

Finding the printed model number

You can try identifying the model number by checking the markings on the device as described in the following Apple article:

Older devices (iPhone 7 and earlier, iPad,  iPod touch) have their model number printed on the back of the device. iPhone 8 and newer models have the model number printed under the SIM slot. To find the model number, you will need to remove the SIM tray and look in the SIM tray slot:

Important: removing the SIM card from a powered-on device may cause undesired consequences. On newer versions of iOS, removing the SIM card may block USB port and biometric sensors (Touch ID and Face ID); you will need a passcode to unlock the phone.

The model number reads “Axxxx” where “xxxx” represent four digits. This number identifies the iPhone generation and model (such as “iPhone 8 Plus”). You can also determine the SoC and the range of iOS versions available for that model. This, in turn, identifies the available acquisition methods (for example, whether or not a checkm8 extraction is available). The four-digit code does not contain information about the intended market of the device, its color or storage size. For all of that, you’ll need to check the device settings.

In addition to device model number, the removable SIM tray may contain information about the device IMEI. Treat this information with due diligence as the SIM tray is easily replaceable.

The iPhone settings

Some iPhone and iPad models look alike, while information printed on the case may be missing, illegible or plain misleading if an unauthorized repair was carried on. The only truly reliable way of checking the model number requires unlocking the iPhone and opening Settings > General > About. To the right of Model Number, you’ll see the part number.

The Model Number will contain the part number. The part number can be used to find out the intended device region, storage capacity, and color. For example, try googling the following part number to find as much information about the device as you can: MGDC3ZD/A.

To find the four-digit model number, tap the part number. You can also tap Software Version to see information about iOS build number.

Using DFU and recovery modes

You can also discover the model number by placing the device to recovery or DFU mode as shown in Everything about iOS DFU and Recovery Modes. This method can be recommended when you cannot determine the model number by examining the phone’s external features, and the iPhone is powered off. You won’t need the passcode for DFU and Recovery.

The recovery mode is the easiest one to use. To place the iPhone to recovery, follow the steps described in If you can’t update or restore your iPhone or iPod touch (under Put your device in recovery mode and set it up again). A limited set of information will be available. While the iPhone is in recovery, you may obtain the following information about the device:

Device Model: iPhone8,1
Model: n71map
ECID: XXXXXXXXXXXXXXXX
Serial Number: XXXXXXXXXXX
IMEI: XXXXXXXXXXXXXXX
MODE: Recovery

Recovery mode may return the following information:

  • Device model: two representations of the device model, e.g. iPhone7,2 (n61ap), iPhone10,6 (d221ap) etc. You can use The iPhone Wiki and List of Apple’s mobile device codes types – GitHub to determine the model number based on the returned device code.
  • ECID (UCID): XXXXXXXXXXXXXXXX. The ECID (Exclusive Chip Identification) or Unique Chip ID is an identifier unique to every unit, or more accurately, to every SoC.
  • Serial number: XXXXXXXXXXX (or N/A)
  • IMEI: XXXXXXXXXXXXXXX (or N/A). Note that we have not seen IMEI information on any of our test devices, with or without a SIM card.
  • Mode: Recovery

To obtain this information, you can use a recent build of iOS Forensic Toolkit. In addition to model number, iOS Forensic Toolkit can display iBoot version, which it then uses to ‘guesstimate’ the installed version of iOS (or a range of iOS versions if there is no specific iOS build linked to that iBoot version):

The DFU mode is significantly more difficult to enter, and is significantly less documented compared to Recovery. In DFU mode, you will see significantly less information compared to Recovery. The only reason to use DFU mode is checkm8 extraction, where applicable.

Why SoC generation matters

The SoC generation affects the range of iOS versions available for a given device, and determines which extraction methods are applicable. We have collected information about SoC generations and extraction methods available for different devices in the following table:

Note: the iPhone SE 3 was released in 2022 with iOS 15.4 on board. While we do support the A15 SoC, we don’t currently have support for iOS 15.4, which means that low-level extraction is not yet available for the iPhone SE 3 (2022).


REFERENCES:

Elcomsoft iOS Forensic Toolkit

Extract critical evidence from Apple iOS devices in real time. Gain access to phone secrets including passwords and encryption keys, and decrypt the file system image with or without the original passcode. Physical and logical acquisition options for all 64-bit devices running all versions of iOS.

Elcomsoft iOS Forensic Toolkit official web page & downloads »


文章来源: https://blog.elcomsoft.com/2022/05/identifying-the-iphone-model/
如有侵权请联系:admin#unsafe.sh