Decryption and forensic system for encrypted iphone backup files based on parallel random search

Abstract

The forensics for the iPhone backup files is an important problem in digital forensics. Since the backup files are often encrypted and the key chain data is always encrypted even if the data is not completely encrypted, it is difficult to deal with this problem by the traditional methods such as sequence brute force. In this paper, we give a new method based on parallel random search on CPU+GPU platform to solve this problem. The main principle of this method is to parallel random search the passwords in the given dictionary based on the CPU+GPU platform in order to crack the password of the encrypted iPhone backup files. An analysis of decryption and reduction method as well as the file structure is also shown in this paper. Finally the experiment result shows that the method given in this paper can greatly improve the efficiency of forensics for the encrypted iPhone backup files.