UFADE: pulling Apple device data on Windows, Linux and macOS from one dialog

A thesis project with a GUI, and the libraries it stands on

UFADE is described as a Universal Forensic Apple Device Extractor, and it was written for a masters thesis in IT security and forensics at Wismar University. It is a Python script with a graphical dialog rather than a command line tool, and the interface is built on CustomTkinter. The heavy lifting is not its own. The readme says it utilizes pymobiledevice3 and iOSbackup to automate the acquisition of Apple mobile devices, and the SSH access is realized via Paramiko. The acknowledgements section names the full set of projects the script draws on, which is a good map of what it does under the hood: pymobiledevice3 for the device protocol layer, iOSbackup and pyiosbackup for the backup formats, CustomTkinter for the interface, crossfiledialog for directory picking, and then pandas, pyarrow, simpleaudio, pdfme and imagehash for the report side. The requirements file pins the versions of several of these, notably pymobiledevice3 at 7.8.3, NSKeyedUnArchiver at 1.5, construct-typing at 0.7.0, pdfme at 0.4.12 and pmd-pytcp at 0.3.7, and it caps exifread below version 3.

Five backup types, and the format changes with each one

The backup options are the substance of the tool, and the differences between them are not cosmetic. The logical, iTunes style backup performs a backup as iTunes would do, with an option to bruteforce an unknown backup password. The logical plus backup performs and decrypts an iTunes backup, gathers AFC media files, shared app folders and crash reports, and creates a TAR archive. The logical plus backup in UFED style creates an advanced logical backup as a ZIP archive with a UFD file that can be loaded into Cellebrite Physical Analyzer. The PRFS backup also decrypts an iTunes backup and gathers the same AFC media, shared app folders and crash reports, but creates a TAR archive structured like the filesystem on the device. The filesystem backup is the one with a hardware precondition, and it creates a full filesystem backup from an already jailbroken device. So three different archive formats are on offer, TAR, ZIP and a full filesystem dump, and the choice you make determines what your analysis tool can read.

The userspace tunnel is the part that changed recently

The developer options section carries the most detailed text in the readme, and it is about how UFADE gets the privileged access it needs. On iOS and iPadOS 17.4 and later, and watchOS 10.4 and later, UFADE opens a USB userspace tunnel without administrator privileges, and it says to install the updated requirements including pmd-pytcp 0.3.7, pair and unlock the device and enable Developer Mode. The tunnel is checked when you reopen developer options, and if an existing one still responds it is reused, while a failed check is logged and the tunnel is rebuilt once automatically, with the check running in the background under a timeout so the user interface stays responsive. The fallback path is deliberate, since the userspace tunnel is also replaced by the existing tunnel flow if setup or service discovery fails, and the tool logs the error and asks for confirmation before starting a privileged tunnel. Two constraints are worth noting. The userspace tunnel is available only inside UFADE and supports one device at a time, and it is closed in the background when you leave the developer area, with closing UFADE not waiting for tunnel cleanup, so after disconnecting a device you reopen developer options to reconnect.

Installing on each platform is a different set of commands

The installation section is written per platform, and the first step is cloning the repository.

git clone https://github.com/prosch88/UFADE

If you want the developer features you need a DeveloperDisk image mounted on the device, and a submodule with images can be loaded while cloning.

git clone https://github.com/prosch88/UFADE --recurse-submodules

The Python side is pinned to version 3.11 exactly, and the system packages differ per distribution. Arch and Manjaro need tk, Debian and Ubuntu need python3-tk and libasound2-dev, CentOS and Red Hat need tkinter through yum, and macOS needs [email protected] and [email protected] from brew.

sudo apt-get install python3-tk libasound2-dev
brew install [email protected] [email protected]

Then the requirements go in, and if you run inside a virtual environment you also need libcairo2 and girepository installed, with pygobject added.

pip install pygobject

Windows is handled differently, because the readme points you at the Apple Devices app from the Microsoft store, and it strongly recommends disabling the maximum path length limitation, which matters because device paths are long and Windows truncates them.

Running it starts with pairing, then a directory prompt

The usage flow is short and the first step is physical. You connect an Apple device, an iPhone or iPad, to your workstation, unlock and pair it, and then you start the script.

python ufade.py

You may then see a trust message on the device screen, and you confirm it with trust, which is the standard pairing handshake. After that you see the device information screen and you are prompted to choose a working directory, with the default set to the directory from which the script was called. That default is worth overriding for an acquisition, because an examiner wants the output in a case folder rather than wherever the script happens to live. From the main menu the options are the device information export, which saves device information and a list of user-installed apps to a text file, the backup options described above, the collection of unified logs which gathers the AUL from the device and saves it as a logarchive, the developer options, and the advanced options, which the readme describes as offering network sniffing and various logging functions.

A companion Android tool and a security award

Two facts outside the code tell you about the project's standing. The author points to ALEX as a comparable tool for extracting data from Android devices, which is useful context because the mobile forensics market has been Apple-heavy for a long time. And UFADE was selected as a finalist for the Sans Difference Makers Award 2024 in the category Innovation of the Year, for an open source or product tool. That is a name-check rather than a certification, and it says nothing about the validation state of the output for a specific case, but it does indicate that the tool was noticed by people who assess forensic tooling. The project is GPL-3.0 licensed, which matters for a tool an examiner may need to modify for a case-specific acquisition, and the repository carries a LICENSE file, a .gitmodules file for the image submodule, a requirements.txt, the main ufade.py entry point and a ufade package directory alongside a ufade_developer directory.

Editorial conclusion

UFADE fits a forensic examiner or IT security student who needs a repeatable acquisition of an Apple device from a Windows, Linux or macOS workstation without writing a pymobiledevice3 script, and who wants the choice between a plain iTunes style backup and a Cellebrite compatible archive. It does not fit a workflow that needs a signed or validated tool for casework, since the project is a thesis script released under GPL-3.0 with a pinned dependency set, and it does not fit a non-jailbroken device where you need the full filesystem, because that path is explicitly for already jailbroken hardware. Before you run it, install the pinned requirements on Python 3.11, mount a DeveloperDisk image if you want the developer features, and check which backup type your downstream analysis tool expects, because the archive format differs between the logical, the UFED style and the PRFS options.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. prosch88/UFADE on GitHub
4. README
5. Releases