iOS 14 + macOS Big Sur = Lots of Images

It has taken a while, but I’m happy to announce an iOS 14 image with documentation is now publically available for download.

This image contains forty-two (42) third party apps.  The list includes the same apps as my iOS 13 images, but with some noteable additions:  Garmin, GroupMe, Microsoft Teams, Slack, and Threema.  Health data was also generated for this image using an AppleWatch, Fitbit Versa 3, and a Garmin Forerunner 35.  Stock iOS apps were also populated with data.

For a complete app listing, please see the documentation.

The extraction comes as a .tar file, but, if the tool you are using can not ingest a .tar file, 7-Zip can be used in a Windows environment to extract the content for a manual examination.  Just make sure to run 7-Zip with administrative level privileges in order to avoid any errors.

There is also an accociated encrypted iTunes backup (password is in the documentation), and set of SysDiagnose logs for the device.

There is an accompanying macOS Big Sur image, which used the same iCloud account as the iOS device.  I thought it would be beneficial to see how actions taken on an iOS device would affect a macOS device and vice versa.  I specifically focused on Safari, Messages, Files, and Photos, so actions taken in those apps on the Big Sur device are documented in the same documentation file as the iOS image, and are denoted accordingly.  Other actions taken in Big Sur (e.g. boots, logins, shutdowns, etc.) are not documented as they fell outside of the scope of the exercise.

The Big Sur device was a virtual machine, so the image arrives as a zip file containing a segmented .E01 image.

There are two additional images.  The first is an image of the same iPhone prior to being updated to iOS 14 (it is basically my iOS 13.4.1 image).  The second image is of the same iPhone after being updated to iOS 14.2; however, no activity taken iafter the update.  I thought it would be neat to see how things get moved around/changed after a major iOS update.

The images and documentation can be found here.  Because there are multiple images and some may not necessarily need everything, I opted to separate the images into individual folders so you can pick which one(s) you want.

Beacuse the iOS images tend to be a bit more popular, please be patient if you encounter any quota/timeout issues.

As always, these images are freely available to anyone who wants them for training, education, testing, or research.  If you do link, please link to this page and not to the image URL as I will eventually be moving the image to a more permanent home.

Enjoy!  🙂