SINF Structure
I spent some time decoding the SINF files that I discussed here, thanks in great part to a link sent to me by a colleague (Thanks, Derrick). Here are my findings, to date:
Unlike iTunes Purchased MP4 media files, the SINF does not contain the iTunes user account name, which is most often their email address and most useful for contacting owners of stolen devices. Instead, you are limited to the iTunes user's name and iTunes ID#. Short of a search warrant or subpoena, Apple is not going to reveal the owner's personal information, though they have contacted owners on my behalf in the past.
Please review the data in the table and compare with your findings, if you are so inclined. Post a comment if you have more insight, find an error, or can confirm any of the information.
Saturday, February 25, 2012
Subscribe to:
Post Comments (Atom)
Time Perspective
Telling time in forensic computing can be complicated. User interfaces hide the complexity, usually displaying time stamps in a human reada...
-
I was asked recently to help recover deleted messages from an iPhone SMS database. Conveniently, this is called "sms.db" on the i...
-
The Google Chrome cache represents a challenge to forensic investigators. If the extent of your examination has been to open t...
-
I commonly use adb and fastboot to access Android devices. Ubuntu has packages for those tools making installation easy: $ sudo apt-get i...
No comments:
Post a Comment