Why can’t FTK display some files in a physical DD image from an Apple device?

Created by: Brendan Bone
Created date:
Last Updated date:

All devices that shipped with or were restored to iOS 4+ encrypt the majority of their data. Because of this, you may not be able to view the contents of some files in FTK unless your images were created with MPE+ 4.7 or later (to obtain the decryption keys) and you are using FTK 4.0.2 or later. An alternative to getting these physical DD images would be to get the deep logical TAR images, which are not encrypted.

Was this article helpful?
0 out of 0 found this helpful
Have more questions? Submit a request


Powered by Zendesk