I’m aways happy to give credit where credit is due.
This week I had a dilemma. At work we have a license for Cellebrite Physical Analyzer (excellent software) but we needed to have the ability to obtain physical images of several iOS devices at several locations at once. We needed to act quickly and as cost-effectively as possible.
It was, at this point, that I was put on to Lantern Lite Imager.
You may be familiar with Lantern. It is used to analyze iOS devices and has a nice little feature that displays everything in a timeline. Very good software.
Lantern Lite Imager, unlike its older brother, is free software that uses the bootloader from the redsn0w jailbreak in order to obtain a full physical image of the iPhone 4 and earlier, and the original iPad. Not only does it obtain a full physical image but it also brute-forces any passcode on the device and decrypts the image.
There are only two negatives that I have discovered:
Even if you already know the passcode there is nowhere to enter it. The software MUST crack the passcode.
Speed. While the software can image the devices quickly it does not decrypt on-the-fly like Cellebrite does. This means that you have to wait for the image to acquire and then wait again for the image to decrypt.
Aside from that, the software is brilliant and I recommend it to anyone… as long as you have a Mac. If you don’t, why not?
5 responses to “Lantern Lite Imager”
Hi, can I ask what output lite gives you? is a dd image? thanks for your help, regards Darren
You end with a dd image of the user partition which you can then import into most forensic software for analysis. Be warned though, if there is a pass-code on the phone you will end up with two images; once encrypted, on unencrypted. This means if you image a 32GB iDevice you will need at least 64GB of storage to complete imaging.
great stuff, cheers Lee! I have encase v6 and v7 so this will happily deal with the DD image.
You say that its free but it seems to only be free if you buy the full product?
This happened since I wrote the article. I’ve been in touch with them and they say that it is still free for everyone, you just have to hunt around for it.