Dmg File Ipad

Posted on  by



IPad 2 Bypass / A5 FactoryActivation. DMG Extract/Build Tool: Windows: Decrypt iPSW DMG files: Unknown: Download: Geeksn0w: Windows: iPhone 4 iCloud Bypass. With the release of the iPhone came the IMG2 file format. They were used on all known iPhone OS 1.x firmwares. For the 1.1.x series, they were encrypted with the 0x837 key. The discovery of the 0x837 key led to the ability to decrypt any 1.x firmware. Following IMG2 came the IMG3 file format.

November 12th, 2020 by Shafik Punja
Category: «Mobile», «Tips & Tricks»
  • 2
  • 9
  • 11

For almost a decade, if not longer, I have collaborated with Vladimir Katalov on various digital forensics research topics. He has always been a great source of guidance, especially on iOS related challenges. When he offered me a standing invitation to post on the Elcomsoft Blog, I felt very humbled and honored to be given the opportunity to post on the ElcomSoft Blog, and I would like to thank the ElcomSoft team. This article has also been prepared together, with Vladimir Katalov.

Background

I had an opportunity to use Elcomsoft iOS Extraction Toolkit (EIFT) 6.52 to perform jailbreak-free extraction of an Apple iPad 5th Generation, running iOS 11.1, with known passcode. This method requires the use of an Apple developer account, installing an acquisition agent on the device, and then using the acquisition agent to obtain a full file system and decrypted keychain. If you don’t know the passcode to the device, then no method will work for a full file system extraction.

The iPadOS 11.1 on this device does NOT make it susceptible to checkm8/checkra1n exploitation techniques. So, why not upgrade the device to at least iOS 12.3 to leverage checkm8/checkra1n methods? I had researched the device serial number on everymac.com and knew that it could accept iPadOS 12.x up to 14.x. What I did not realize, until Vladimir corrected my understanding, is upgrading this Apple iPad from 11.1, will force iPadOS 14.1 to be installed.

In my dialogue with Vladimir, he reminded me that: “The article at everymac.com is only partially correct – it only describes what versions of iOS can run on this model; however, the *only* one you can install now (after reset or as upgrade) is 14.1. For years, Apple implements specific “protection” by allowing only last version (sometimes also the previous one) to be installed; when you install or upgrade, it connects to Apple servers and verifies the signature. Right now, only 14.1 is signed. So, you will not be able to use checkra1n/checkm8 extraction for this model, no way at all.”

The ONLY option left in this case was to perform a jailbreak-free extraction using Elcomsoft iOS Extraction Toolkit (EIFT) 6.52 [1].

Vladimir also stressed the following about the forensic soundness of various full file system extraction methods: “Generally speaking, checkm8 extraction is almost forensically sound (it *temporary* [sic] modifies a couple of system files); the second place goes (I would say, 99%) goes to our agent acquisition, and checkra1n is the worst, as it makes tons of modifications to the file system. In any case, agent acquisition is your only option (until may be someone will implement checkm8 acquisition for systems less than 12.3).”

The purpose of the article will be to describe a digital forensic practitioner’s experience with using EIFT 6.52 on a Mac running macOS Catalina 10.15.7.

The processes covered in this article will cause the device to undergo changes, such as sideloading an app for extraction purposes, and being connected to the Internet. For this specific situation there is no known or identified risk of a remote device wipe being initiated should the device need to be connected to the Internet. While this is not the most ideal forensically sound method by which to obtain data from a device, in this case this is the only option available for a full file system extraction. The digital forensics practitioner should keep a detailed set of notes documenting the processes followed.

Preparation

After downloading and unpacking the latest version of Elcomsoft iOS Extraction Toolkit (EIFT) archive, the digital forensics practitioner should be aware of how to properly install and run EIFT specifically on a Mac. Read this article first, if you are using a Mac, before the mounting the EIFT DMG file. The instructions are outlined in the article ‘Installing and using iOS Forensic Toolkit on macOS 10.15 Catalina’ (published Oct 2, 2019 by Oleg Afonin).

In my previous experience with using EIFT on a Mac, the instructions as outlined in the above referenced article have worked. A summary of these instructions, for Mac only, is provided below.

File
  1. Remove the quarantine flag, ‘com.apple.quarrantine’, from the EIFT DMG file, using the ‘-d’ flag option.

xattr -r -d com.apple.quarantine <path_to_dmg>

  1. If the EIFT DMG file is on the desktop the command is typed as shown below.

xattr -r -d com.apple.quarantine Desktop/iOS-Toolkit-6.52-Mac.dmg

If you forget to follow the steps for removing the quarantine flag from the EIFT DMG file, you will end up getting Gatekeeper alerts like the one shown in the screenshot. And unfortunately, you won’t only get one, but a number of successive alerts each time a component of the EIFT is being executed.

Removing the quarantine flags from the EIFT DMG did not work in my case, even after several attempts. Although these instructions have worked previously.

A workaround is to disable Gatekeeper temporarily using the command shown below.

sudo spctl –master-disable

The following screenshot shows the System Preferences -> Security & Privacy > General screen where under ‘Allow apps downloaded from:’ now displays ‘Anywhere’ as the selected option.

Please remember to reenable Gatekeeper when you are finished using EIFT, with the command shown below.

sudo spctl –master-enable

The following screenshot shows the System Preferences -> Security & Privacy > General screen where under ‘Allow apps downloaded from:’ the ‘Anywhere’ option is no longer present. And my Mac device has reverted back to its previous setting ‘App store and identified developers’.

If you are using the Windows version of EIFT, then you don’t have to worry about the information presented above. Whether on MacOS or Windows, ensure you temporarily disable your antivirus, as the components of the EIFT may very likely end up being quarantined by your AV/anti-malware solution. Just don’t forget to reenable your AV/anti-malware solution after you are finished!

Apple Developer Account

Leveraging the use of an Apple Developer Account has been explained in a previously released article titled ‘Extracting iPhone File System and Keychain Without an Apple Developer Account’ (published September 3, 2020 by Oleg Afonin).

In my discussions with Vladimir he indicated that:

  • Agent extraction is simple enough, but it is highly recommended to have developer account at Apple.
  • If you don’t have an developer account at Apple, there are two options:
    • Use “normal” Apple ID account (your personal or temporary); it is only needed for agent installation. You will have to connect the device temporarily to the Internet to approve the certificate; it might be a problem if the “Find My” option is enabled, and you may receive the remote lock/wipe command (until you set up firewall properly, as described in Setting Up Restricted Internet Connection for iPhone Extraction article).
    • Temporary connection of your Apple ID to somebody else’s developer account.
  • Ensure you have 2FA on the Apple ID you are using, and have access to a trusted device connected to this Apple ID (any one: iPhone, iPad or Mac)

I used a temporary custom created Apple ID (with 2FA enabled), that was then invited to join the development team of some other company.

Running EIFT

Mount (open) the iOS Toolkit DMG file. Pay close attention to the directions provided in this article ‘Installing and using iOS Forensic Toolkit on macOS 10.15 Catalina’ (published Oct 2, 2019).

IMPORTANT: Do NOT launch EIFT directly from the mounted image! You MUST create a new directory on your Mac (e.g. on your Desktop) and copy the entire content of the mounted disk to that new folder. You can unmount and delete the DMG afterwards.

Make sure your licensed EIFT USB dongle is inserted into the USB port of your laptop. After copying the contents of the DMG file to a new folder, run the “Toolkit.command” file that is in the folder, by double clicking on it.

After running the “Toolkit.command” a terminal window will open with a ‘Welcome to Elcomsoft iOS Forensic Toolkit’ banner message. The screenshot below shows that no device is connected. After connecting the device, it must be paired with the Mac, by accepting the trust relationship prompt that is presented on the device by pressing ‘Trust’.

Once the device is connected, EIFT will detect it. Basic device information can be collected using the ‘I’ command.

Once the ‘I’ command is executed, EIFT will obtain device information and generate 3 files: ideviceinfo.plist, applications.txt and applications.plist, shown the screenshot below. If you have identified the error in the screenshot, no need to bother Vladimir as he is already been made aware of it.

Install Acquisition Agent

From the main menu under ‘Acquisition agent’ select ‘1 INSTALL’.

This initiates the installation process for the acquisition agent application, by sideloading it over USB connection on to the device. There are two options for signing the acquisition agent. Option 1 uses the “developer” signing and Option 2 uses the custom Apple ID that was created.

Selecting either option 1 or 2 will begin the acquisition agent installation process. I first tried option 1.

On the device you should now see an application icon that is named ‘Acquisition’.

Following the directions provided after installing it, launch the Acquisition agent. In the Acquisition agent app screen there are two messages, one at the top and the other at the bottom: ‘Waiting for AcquisitionClient connection’ and ‘Please keep application in foreground for correct work’.

File System Extraction

Ensure the device is unlocked and the Acquisition agent on the device is running in the foreground. From the EIFT main menu under ‘Acquisition agent’ select ‘3 FILE SYSTEM’ to obtain the full file system. This initiates the exploitation process and subsequent full file system extraction through the Acquisition agent.

What should be observed, on the device in the Acquisition agent interface, is listing of the files being extracted. Instead what I observed was the device rebooting, regardless of trying ‘2 KEYCHAIN’, 3 FILE SYSTEM’ or ‘4 FILE SYSTEM (USER)’. So, like any dedicated practitioner, began troubleshooting: rebooted the Mac, the device, changed cables and USB ports. During this process Internet access was NOT enabled on the device.

The only other choice left was try option 2, custom Apple ID. First, I uninstalled the agent using the command ‘5 UNINSTALL’ so as to remove the agent that was installed with option 1. I then repeated the install process by selecting 2 to sign the agent and install it.

The agent was confirmed as being installed on the device, but starting it caused the device to respond with ‘Unable to Verify App’, and to verify the trust of the developer required an Internet connection. At this juncture, there is no other recourse but to enable Internet access to the device.

Once Internet access to the device was successfully established, a second device challenge was presented with an ‘Untrusted Developer’ warning. Apple iOS security mechanisms do not allow unverified apps (that is, apps not accessed from the Apple App Store) to be run on Apple devices without the device user manually verifying the “untrusted application” application.

To allow the Acquisition agent app to run, on the device, under General -> Device Management -> Developer App, the trust must be manually accepted by the device user. In the screenshot below the Acquisition agent is now trusted.

In the EIFT menu in the ‘Acquisition agent’ select ‘3 FILE SYSTEM’, to begin extracting the full file system. Using option 2, custom Apple ID method works with obtaining a file system extraction. Note that the data is extracted to the user’s home directory. The resulting full file system extraction is output to a TAR archive that is named using the UDID value of the device.

Following a successful full file system extraction, the decrypted keychain was also obtained through the EIFT menu in the ‘Acquisition agent’ select ‘2 KEYCHAIN’. This data is also saved to the user’s home directory as an XML file that is prefixed with the filename ‘keychain’.

Satisfied that all the information being sought has been obtained, the following steps are followed prior to departure from the device and EIFT:

  • Uninstall the Acquisition agent from the device by choosing ‘5 UNINSTALL’ from within the EIFT menu.
  • Disconnect the device from the Internet.
  • Verify on the device that the Acquisition agent app is no longer present.
  • On the Mac used for extraction, don’t forget to reenable Gatekeeper as noted earlier in this article, and of course also reenable your AV/anti-malware application.

The resulting extracted full file system TAR file can be ingested into almost any if not all free open source and commercial digital forensic analysis tools that parse Apple iOS data. There is, of course, the matter of the option 1 signing Apple ID failing. At this time neither myself nor Vladimir can explain why it failed.

Thank you for taking the time to read this and take care.

Sources/References

Acknowledgements

Thank you to my dear friend and colleague Doug Kraan (Digital Forensics Analyst, Digital Forensics Team, Calgary Police Service), for reviewing this article.


  • 2
  • 9
  • 11

Nov 12, 2019 About DMG Files Our goal is to help you understand what a file with a.dmg suffix is and how to open it. The Apple Disk Image file type, file format description, and Mac, Windows, and Linux programs listed on this page have been individually researched and verified by the FileInfo team. Nov 29, 2018 We hope this helps with clarifying how to open zip files on an iPhone or iPad. Unfortunately, a perfect native iOS solution doesn’t exist as of yet, however, even with a free app you can access zipped contents with fairly little hassle. Nov 13, 2019 How to Open DMG Files. This wikiHow teaches you how to open a DMG file on a Mac. Since DMG files are used predominately to install applications on Macs, you cannot properly open DMG files on Windows computers. Aug 13, 2018 All you really need to do is double-click the DMG file to open it and mount it to your Mac. The DMG mounts in two places: on your desktop and in the Finder sidebar under your hard drive. Clicking either one of these opens the DMG file. When you open a DMG file, you’ll usually see two things: the app and a link to your applications folder. Nov 05, 2016 hey guys I've downloaded an ISO file. It gives me the option to open it with OneDrive, Av player, Documents and TDownloader however none of them work. I read that the file can be opened with vlc but the 'open in' isn't giving vlc as an option. I've trie importing them to each app then seeing.

Open DMG File

DMG is used for disk image files on Macintosh computers running Mac OS X. This file extension replaces the older file extension IMG which was discontinued during the release of later series of Mac operating systems. You can open DMG file on Mac, Linux, and Windows operating systems but it will require additional software to be installed on Windows. Note that on Windows and Linux you cannot open every DMG file, since there are certain software limitations on DMG format variation.

DMG files are used by Apple for software distribution over the internet. These files provide features such as compression and password protection which are not common to other forms of software distribution file formats. DMG files are native to Mac OS X and are structured according to Universal Disk Image Format (UDIF) and the New Disk Image Format (NDIF). They can be accessed through the Mac OS Finder application by either launching the DMG file or mounting it as a drive.

DMG is also referred to as the Apple’s equivalent to MSI files in Windows PC. Non-Macintosh systems may access DMG files and extract or convert them to ISO image files for burning. Several applications are designed to offer this solution for Windows systems.

7-Zip and DMG Extractor are the best options to open DMG file on Windows because they are compatible with the most DMG variations. For Linux a built-in 'cdrecord' command can be issued to burn DMG files to CD's or DVD's.

Aside from the Finder application, you can open DMG files through Apple Disk Utility, Roxio Toast, and Dare to be Creative iArchiver for Mac platform. On the other hand, additional applications such Acute Systems TransMac, DMG2IMG, and DMG2ISO can be installed on Windows to fully support the files.

Read how you can open DMG files on Mac OS, Windows and Linux.

DMG files are transferred over e-mail or internet using application/x-apple-diskimage multipurpose internet mail extensions (MIME) type.

Following file types are similar to DMG and contain disk images:

  • ISO File - ISO disk image file
  • IMG File - IMG disk image file
  • VHD/VHDX File - Virtual Hard Drive image file

Find your files

The Files app includes files on the device you're using, as well as those in other cloud services and apps, and iCloud Drive. You can also work with zip files.* To access your files, just open the Files app and choose the location of the file you're looking for.

Save a copy of your file locally

You can find locally stored files in On My [device], under Locations. On your iPad, simply drag files into the On My iPad folder to store them directly on your device. If you want to save a file locally on your iPhone or iPod touch, follow these steps.

  1. Go to the file that you want to store on your device.
  2. Tap Select > the file name > Organize .
  3. Under On My [Device], choose a folder or tap New Folder to create a new one.
  4. Tap Copy.

Install Dmg On Ipad

You can also long press on a file, choose Move, and select which folder you want to copy it to.

Create dmg dvd on windows 8. On iOS 12 or earlier, tap the file and choose Move. Then, under On My [device], choose Numbers, Keynote, or Pages, and tap Copy.

Move iCloud Drive files

  1. Go to the file that you want to move.
  2. Tap Select, then choose the file.
  3. Tap Organize .
  4. Under On My [Device], choose a folder or tap New Folder to create a new one.
  5. Tap Move.

You can also long press on a file, choose Move, and select which folder you want to copy it to.

Look for files on your Mac or PC

  • On your Mac, choose Go > iCloud Drive from the menu bar, or click iCloud Drive in the sidebar of a Finder window.
  • On iCloud.com, go to the iCloud Drive app.
  • On your PC with iCloud for Windows, open File Explorer, then click iCloud Drive.

* Password protected zip folders or directories are not supported in the Files app.

Organize your files

It’s easy to organize all of the files stored in iCloud Drive — including Pages, Numbers, and Keynote documents. When you make changes on one device, your edits are automatically updated on every device using iCloud Drive.

You can make your own folders. Or rename the files and folders you already have when you press firmly on them.

Create new folders

  1. Go to Locations.
  2. Tap iCloud Drive, On My [device], or the name of a third-party cloud service where you want to keep your new folder.
  3. Swipe down on the screen.
  4. Tap More .
  5. Select New Folder.
  6. Enter the name of your new folder. Then tap Done.

How Do I Open A Dmg File On My Ipad Mac

Install Dmg On Ipad

On iOS 12 or earlier, tap New Folder . If you don't see New Folder or it's gray, then the third-party cloud service doesn't support new folders.

View your files by name, date, size, or the tags that you add. With colorful and custom labels, you can assign tags to your files any way that you like. That means you'll quickly find just the project or document you need.

Add a tag

Dmg
  1. Tap Select.
  2. Tap the file that you want to tag.
  3. Tap Share > Add Tags .
  4. Choose the tag that you want to add.

Dmg File On Ipad

Rename a tag

  1. Go to Locations.
  2. Tap More > Edit.
  3. Tap the name of an existing tag.
  4. Enter the name of your new tag.
  5. Tap Done.

Delete files

Macos create dmg command line. Select the files that you don't want anymore and tap Delete . If you delete files from the iCloud Drive folder on one device, they delete on your other devices too. iCloud Drive removes the files from every device that you're signed in to with the same Apple ID.

Ipad

When you delete a file from iCloud Drive or On My [device], it goes into your Recently Deleted folder. If you change your mind or accidentally delete a file, you have 30 days to get it back. Go to Locations > Recently Deleted. Select the file that you want to keep and tap Recover. After 30 days, your files are removed from Recently Deleted.

You can also sign into iCloud.com from your Mac or PC, then go to iCloud Drive and check Recently Deleted.

Share and work on files with your friends

Want to share a document with a friend or colleague? Send them a link to any file stored in iCloud Drive directly from the Files app. Select the file, tap Share , and select Add People. You can also share a copy of your file through AirDrop, Messages, Mail, a shared note, and more.

Or maybe you want to collaborate on a project in real time. The Files app lets you do that too with your Pages, Numbers, and Keynote documents. Select the file and tap Share or > Add People . You can invite them to collaborate through Messages, Mail, or copy and paste a link. Your participants are color-coded. And you can see when they're online, actively working on your shared document.

Use third-party apps in Files

The Files app lets you add your third-party cloud services — like Box, Dropbox, OneDrive, Adobe Creative Cloud, Google Drive, and more — so that you can access all of your files on all of your devices. The files you keep in iCloud Drive automatically appear in the Files app, but you need to set up your other cloud services to access them in the Files app too.

Add third-party apps

  1. Download and set up the third-party cloud app.
  2. Open the Files app.
  3. Tap the Browse tab.
  4. Tap More > Edit.
  5. Turn on the third-party apps that you want to use in the Files app.
  6. Tap Done.

If you don't see one of your third-party cloud services in the Files app, check with your cloud provider.

On iOS 12 or earlier, open the Files app then tap Locations > Edit to add third-party apps.

Move third-party cloud files

  1. Open the file that you want to move.
  2. Tap Share > Copy.
  3. Open the folder where you want to move your file.
  4. Firmly press the screen.
  5. Tap Paste.

Do more with Files on iPadOS

If you're on iPadOS, you can access files on a USB flash drive, SD card, or hard drive through the Files app on iPadOS. Just connect the storage device, and then you can select it under Locations. You can also connect to unencrypted storage on a file server, if that storage is using the APFS, Mac OS Extended, MS-DOS (FAT), or ExFAT format. You also have the option to view your files in Column View, which is helpful if you have files nested in multiple folders. Column View lets you see previews of files and offers access to tools like markup and rotate without even opening a file.

Connect to a file server

  1. Open the Browse tab.
  2. Tap More .
  3. Select Connect to Server.
  4. Enter the SMB address.
  5. Tap Connect.
  6. The server name appears under Shared in the Browse menu.

Switch to Column View

  1. In landscape mode, open the Browse tab.
  2. Select a folder.
  3. Swipe down on the right side of the screen.
  4. Select Column View in the upper right.
  5. Tap a folder to expand its contents.
  6. Tap a file to see a preview.

To leave Column View, tap Grid View or List View , or use your iPad in portrait mode.

If you need help

  • Update your iPhone, iPad, or iPod touch to the latest iOS, or iPadOS.
  • Set up iCloud on all of your devices and turn on iCloud Drive.
  • Make sure that you’re signed in to iCloud with the same Apple ID on all of your devices.
  • If you want to upload, download, or share files using cellular data, open Settings, select Cellular, scroll down to iCloud Drive and any third-party cloud services you use, and turn it on for each service.

If you don't want to access your iCloud Drive files in the Files app, you can choose to download and add only third-party cloud services instead.