How To Deploy Rocket For iPhones
The Rocket is simple to deploy because it fully automates the disk imaging process on the remote iPhone from preservation request to transfer to AWS S3 storage.
Custodians receive an email containing the Rocket link. Once clicked from the designated device, Rocket auto preserves the data and instantly uploads to AWS S3. Once completed Rocket sends an email confirmation with the download link. Login and track any Rocket collection in real time from your phone or computer.
Custodian Participation
- On the computer, open the email and click the Rocket link.
- Click "I Agree"
- Connect the iPhone via USB cable to the computer.
- Click start at the Rocket window.
Custodian Features
- No agents, authorization codes, storage collection kits required.
- Custodian can start the collection from anywhere, 24x7 on-demand.
- No forensic examiner on the other side required.
- Pause and resume the data collection as needed.
- If the connection breaks Rocket will automatically retry and pick up where it left off
Step 1. Choose your computer preservation method
Targeted Collection
The targeted collection option will focus on IOS text messages and attachments
- IOS MMS SMS text messages with attachments. Downloaded as an image that you can import into your favorite analysis tool (Cellebrite, Paraben, Magnet etc)
- Import into your mobile tool (Cellebrite, Axiom, Oxygen, Paraben)
Logical Collection
Logical collections preserves all of the user data, application data, chats, email, texts and more.
- Import into your mobile tool (Cellebrite, Axiom, Oxygen, Paraben)
Step 2. Choose a deployment method
Send an Email Request
Rocket sends a personalized data collection request email to the custodians that you added to the collection list.
Rocket's Data Preservation Request Email Features:
- Speed Test: Trying to decide if you should send a blank drive or have the custodian transfer the preserved image(s)to S3 storage? There's a speed test link that in seconds measure the endpoint's internet upload speed. The results are sent back to the Rocket dashboard.
- Rocket Link: Once clicked the custodian can submit their computer data directly to your pre-selected S3 bucket. It's fully automated and on-demand.
- Customize The Message: Change the mail body message as needed.
- Track The Request: Track the status of the data collection request from the dashboard, in real time.
- Send a Reminder Request: Nudge the custodian to click the link with a reminder email.
Copy & Paste The Rocket Link
Skip the email, this option allows you to copy and paste the email into your legal hold or data preservation request email.
Full Disk
The full disk option will bit level preserve the entire physical hard drive, including the slack and deleted space.
Available Options For Full Disk:
- Preserve by physical drive number.
- Choose all connected physical drives.
- All USB drives.
- All physical drives
Step 3. Choose a storage destination
Save To AWS S3
All Rocket data collections come with AWS S3 storage. Investigators can select from various AWS S3 regional locations to preserve the endpoint.
Available Options For AWS S3 Storage:
- Every data collection includes your choice of storage location.
- Instant transfer from the endpoint to your pre-selected S3
- S3 hosting (21 days for Express users and 30 days for Enterprise users)
- Download using the integrated AWS S3 download tool.
- Express users can create and link their own S3 buckets.
Save To Network Share
Save the data collections to the onsite network share, just ask the IT department for the UNC path to the network share they want to use.
Save To Custodian's USB
Rocket will save the preserved images to the custodian's USB connected hard drive.
Step 4. Add or import your list of custodians
Save To AWS S3
Enterprise Users: can import a list of custodians from a spreadsheet. Once imported Rocket will send the personalized data preservation request email to each custodian.
Express Plan
Express Users: import custodians one at a time. Once added, Rocket will send the personalized data preservation request email to the custodian.