When you have a jailbroken device as evidence, we strongly recommend getting a Full File System extraction. When you have a jailbroken device that you can leverage for research or that has already been acquired, this solution is for you. ArtEx is a tool built for validation. However, it also offers support beyond validation to include acquisition of jailbroken devices and the opportunity to experience a live GUI view of a jailbroken device.

Think about it. You are asked what a deleted contact looks like. You create a contact and delete it. Wouldn’t it be so much faster to just manually look at the data on the fly vs. creating a full forensic extraction and waiting for it to parse? With a jailbroken device, this can be done.

First, launch 3uTools and select Open SSH Tunnel. If you don’t immediately see the option, type SSH into Find Tool. Once open, select OK.  You may get errors if Cydia isn’t installed on the device.