iPod devices have a name. It's set by the user when they initialize the device through iTune's (there are alternate initialization methods, but that is not the focus of this post). When the focus of the investigation is determining the device owner, the device name is a good place to start. The device name, for example, could be "John Doe" and you happen to know who is John Doe, or how to find out.
Of course, the device name could be 'Pookie', which won't help you out too much. But, don't give up, I've already demonstrated another, even more useful, method for identifying iPod owners through iTune's purchased media. Take a look here if that interests you.
But, I got curious, where in the iPod can you find the device name? It's clearly stored on the device, because, as any iPod owner can tell you, if you navigate from the main menu to the 'About' screen in 'Settings', you'll see something akin to "John Doe's iPod."
Where to Look
The first place to look in a FAT formatted iPod is the volume label of the data volume (aka partition). The current device name is the volume name. You can view it with blkid, or for the forensically inclinded, with the sluethkit at the root level.
I'll use recent 5th gen Nano I recently examined as an example. I am operating as root because I am examining a device directly:
# blkid /dev/sdd1
/dev/sdd1: LABEL="PINK PANTHE" UUID="E0B8-3334" TYPE="vfat"
/dev/sdd1: LABEL="PINK PANTHE" UUID="E0B8-3334" TYPE="vfat"
# fls /dev/sdd1
r/r 3: PINK PANTHE (Volume Label Entry)
d/d 5: iPod_Control
...
r/r 3: PINK PANTHE (Volume Label Entry)
d/d 5: iPod_Control
...
Now, I'm fairly worldly (all my friends are now rolling their eyes), but I suspected when I check Settings | About, the device name on this Nano, I'd find the device name was 'Pink Panther', not the truncated 'Pink Panthe' that was in the volume, which has a limit of 12 characters. And sure enough, that's what I found: 'pink panther.'
So, if the 'r' in pather isn't in the volume, then the volume is not the source of the data in the About screen. So, what is the source? Turns out, after mounting the device read-only and employing my favorite keyword search utility (more on that one later), the source turns out to be the 'Library.itdb' SQLite database in the 'iPod_Control/iTunes/iTunes Library.itlp/' directory.
I found the table in which the device name resides as follows:
# sqlite3 '/media/iPod/iPod_Control/iTunes/iTunes Library.itlp/Library.itdb' .dump | grep 'pink panthe'
INSERT INTO "container" VALUES(-3226555229562403833,0,333435002,347345556,'pink panther',100,0,1,0,1,0,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL);
What I did there was dump the table contents, which shows the commands that were issued to create the database and populate it. The dump, when saved to a file, can be used to backup and restore a database. For my purpose, I see that a list of values, including 'pink panther' was inserted into the 'container' table.
Now, I can produce a nice query that can be used in future examinations to directly recover the device name from the Library.itdb database:
# sqlite3 -line '/media/iPod/iPod_Control/iTunes/iTunes Library.itlp/Library.itdb' 'select name from container'
name = pink panther
name = pink panther
Now I have two sources for the device name in a FAT formatted device. And, the database query can be used for HFS formatted iPod Classics, presumably. Combine that with the media search for Apple Store account and real name information, and even an unallocated search for MPEG-4 metadata (next post), and you have a robust, though not fool proof methodology for identifying iPod owners.
