M.E.A.T. - Mobile Evidence Acquisition Toolkit Logo

M.E.A.T. - Mobile Evidence Acquisition Toolkit

0
Free
Visit Website

Meet M.E.A.T! From Jack Farley - BlackStone Discovery. This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices (and Android in the future). Requirements to run from source: Windows or Linux, Python 3.7.4 or 3.7.2, Pip packages seen in requirements.txt. Types of Acquisitions Supported: iOS Devices Logical - Using the logical acquisition flag on MEAT will instruct the tool to extract files and folders accessible through AFC on jailed devices. The specific folder that allows access is: \private\var\mobile\Media, which includes folders such as: AirFair, Books, DCIM, Downloads, general_storage, iTunes_Control, MediaAnalysis, PhotoData, Photos, PublicStaging, Purchases, Recordings. Filesystem iOS Device Prerequisites: Jailbroken iOS Device, AFC2 Installed via Cydia. Using the filesystem acquisition flag on MEAT will instruct the tool to start the AFC2 service and copy all files and folders back to the host machine. This method requires the device to be jailbroken with the following package installed: Apple File Conduit 2. This method can also be changed by the user using the -filesystemPath flag to instruct MEAT to only extract specific folders.

FEATURES

ALTERNATIVES

A library to access and parse Windows XML Event Log (EVTX) format, useful for digital forensics and incident response.

Customizable live OS constructor tool for remote forensics and incident response.

Second-order subdomain takeover scanner

DFIR ORC Documentation provides detailed instructions for setting up the build environment and deploying the tool.

OSXCollector is a forensic evidence collection & analysis toolkit for OSX.

A reliable end-to-end DFIR solution for boosting cyber incident response and forensics capacity.

Comprehensive suite for advanced file analysis and software supply chain security.

Recover event log entries from an image by heuristically looking for record structures.