+ Reply
Results 1 to 3 of 3

Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.


Thread: dd Doesn't work on block device?

is a discussion within the

General iPhone Chat

forums, a part of the

iPhone Modding

section;
Hi All, I am a forensic examiner attempting to take a physical acquisition image of an iPhone 3GS with the firmware 3.1.2 installed. I have successfully jailbroken the phone and
...
  1. #1
    What's Jailbreak?
    Join Date
    Jan 2010
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Default iPhone 3GS firmware 3.1.2 Forensic/DD Imaging Trouble
    Hi All,

    I am a forensic examiner attempting to take a physical acquisition image of an iPhone 3GS with the firmware 3.1.2 installed. I have successfully jailbroken the phone and installed sshd. I need to take a physical disk image of the user data partition.

    To that end, I log into the phone, and :

    Code:
    iPhone:/dev root# cat /etc/fstab
    /dev/disk0s1 / hfs rw 0 1
    /dev/disk0s2s1 /private/var hfs rw,nodev 0 2
    This indicates that /dev/disk0s2s1 is the user data partition.

    What I find interesting is over here in /dev :

    Code:
    iPhone:/dev root# ls -lsha|grep disk
       0 brw-r-----  1 root operator 14,  0 Jan 11 10:19 disk0
       0 brw-r-----  1 root operator 14,  1 Jan 11 10:19 disk0s1
       0 brw-r-----  1 root operator 14,  2 Jan 11 10:19 disk0s2
       0 brw-r-----  1 root operator 14,  3 Jan 11 10:19 disk0s2s1
       0 crw-r-----  1 root operator 14,  0 Jan 11 10:19 rdisk0
       0 crw-r-----  1 root operator 14,  1 Jan 11 10:20 rdisk0s1
       0 crw-r-----  1 root operator 14,  2 Jan 11 10:19 rdisk0s2
       0 crw-r-----  1 root operator 14,  3 Jan 11 10:20 rdisk0s2s1
    Notice all of the disks prefixed with 'r' in their filenames are character devices, while the rest are block devices. Well, it took me a while, but I finally got a working umount binary working.

    Code:
    iPhone:/dev root# umount -f /private/var/
    iPhone:/dev root# dd if=/dev/disk0s2s1
    dd: reading `/dev/disk0s2s1': Invalid argument
    I have, however, noticed that I am able to copy the /character devices/ without any problems. So, what does it take to get `dd' to copy a block device? On linux and unix it will do this without any issues. I tried to compile my own dd for the target arch, but at the end of the day it just says "killed". My guess is some sort of unsigned binary problem or something.

    I really just need to be able to use dd against the block devices so I can take the image and get it over with. Thanks in advance.
    Last edited by Examiner; 01-11-2010 at 11:07 AM. Reason: Title Change

  2. #2
    What's Jailbreak?
    Join Date
    Jan 2010
    Posts
    3
    Thanks
    1
    Thanked 1 Time in 1 Post
    Quote Originally Posted by Examiner View Post
    Hi All,


    Code:
    iPhone:/dev root# umount -f /private/var/
    iPhone:/dev root# dd if=/dev/disk0s2s1
    dd: reading `/dev/disk0s2s1': Invalid argument

    Did you forget to remount the drive?

    Code:
    mount -o ro /private/var
    I'm having trouble with a "Resource Busy" error when using dd and hope to find a solution. Let me know if you get it working.

    Clof

  3. #3
    What's Jailbreak?
    Join Date
    Jul 2010
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Default Re: dd Doesn't work on block device?
    Quote Originally Posted by cliffclof View Post
    Did you forget to remount the drive?

    Code:
    mount -o ro /private/var
    I'm having trouble with a "Resource Busy" error when using dd and hope to find a solution. Let me know if you get it working.

    Clof
    Try using the device "/dev/rdisk0s2".

    The following command string worked for me:

    dd if=/dev/disk0s2 conv=sync,noerror bs=4k

    This command dumped an entire copy of the 16GB of flash memory in my iPhone 3G (firmware 3.1.3) to a "dd" image (via netcat) which I simply renamed with a ".dmg" extension, and was able to mount on my mac and view all of the files. Look underneath the "/mobile/Library" folder for the user's data.

Posting Permissions
  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts