Whose iPod
iPods, iPods, everywhere...
...Which means they are frequently lost or stolen. ...Which means they end up in my office with a request attached stating, "Can you please try to figure out who owns this?"
Device Name
iTunes, the principal means for managing iPod content, allows users to name their device. Usually, owners put their names, like John Doe, so the the device is reported in iTunes as John Does iPod. In a fat32 formatted device, like an iPod Nano, the device name is recorded as the volume label.
When it comes to linking the device to owners, though, the device name is seldom enough. John Doe might be too common a name, not listed in the phone book or in your records management system. Worse, the device name might be Wookie. What then?
What Apple Doesnt Tell You
The Apple Store, commonly known as the iTunes store, sells media for playback on the device. Music and Video are popular purchases, and are sold in the MPEG-4 format with file extensions of .m4p (music) and .m4v (video).
The purchaser of this content has to create and use an Apple Store account. For quite some time, the account name is the users email address. Users provide there real names as part of the creation process, which is necessary for credit card transactions. Very standard business practices, nothing nefarious here.
The slight of hand comes on download (well, it would have to occur before download for you precise-types). The Apple Store account name and the purchasers real name are embedded in the media file! MPEG-4 files contain metadata (data about data) such as the Artist, Title, Album, even album cover art. The metadata takes the form of key:value pairs, often referred to as atoms.
Where to look
The atoms name and apID contain the purchasers real name and account name (email address) respectively. However, no tools I am aware of automatically display this content. The excellent exiftool by Phil Harvey will display the account name (apID atom, i.e., email address) but not the purchasers real name.
While Harveys tool is excellent, it just doesnt do to run exiftool against every media file on an iPod. First, not every media file is an MPEG-4 with Apple Store metadata. iTunes allows users to convert their existing mp3 and CD collections to MPEG-4, for example. These media files take on the .m4a file extension and do not contain purchaser information. Nor do .mp3s, for that matter.
When Im in a hurry, which is most of the time, I resort to a straight forward, compound command:
$ find /media/iPod/iPod_Control/Music -type f -name "*.m4[pv]" | while read i; do strings -f "$i"|grep -E -m1 name.+; strings -f "$i"| grep -E -m1 -A2 apID; done
Am I out of my flipping mind? No. That really works, works well, and works really, really fast. Should I explain it? No, not unless you really want me to. The output looks like this:
/media/iPod/iPod_Control/Music/F49/PFLT.m4v: 8apID
/media/iPod/iPod_Control/Music/F49/PFLT.m4v: 0data
/media/iPod/iPod_Control/Music/F49/PFLT.m4v: jdoe@email.com
/media/iPod/iPod_Control/Music/F49/QQDN.m4p: nameJohn Doe
/media/iPod/iPod_Control/Music/F49/QQDN.m4p: 8apID
/media/iPod/iPod_Control/Music/F49/QQDN.m4p: 0data
/media/iPod/iPod_Control/Music/F49/QQDN.m4p: jdoe@email.com
Pretty? Maybe not. Does it answer the question of what is the real name and email address of the media purchaser? Yes. And did I mention, really, really fast?
Im aware that some people might like or need nicer output for a report of some kind. I wrote a bash script , called iphone_music that works with exiftool to produce nice output:
======== /media/iPod/iPod_Control/Music/F49/PFLT.m4v
File Type : M4V
Apple Store Account : jdoe@email.com
Apple Store Account Type : iTunes
Apple Store Real Name : John Doe
======== /media/iPod/iPod_Control/Music/F49/QQDN.m4p
File Type : M4P
Apple Store Account : jdoe@email.com
Apple Store Account Type : iTunes
Apple Store Real Name : John Doe
Iphone_music is also quite fast and uses the same basic methodology as the find command first demonstrated. Additionally, it can tell you the names, artists, albums, etc. of other media on the device for instances where the owner has no purchased media on the device but can describe the media on board (e.g., .mp3, .m4a). You may have noticed from the paths of the media files demonstrated, iTunes does not name the files after their content.
Iphone_music can be vastly improved, such as sorting by artist, email, owner name, etc, and Ill likely rewrite the tool in python to facilitate implementing these features.
Final Note (pun intended)
The methods detailed here work on mounted file systems and allocated files. It is possible to find the real name and email address on devices where the media files have been deleted by the iPod thief / finder. I wont detail the process here, but it involves using the Sleuthkit to pipe unallocated space to strings and grep for the name and apID atoms. Another method, though slower, would be to use photorec or another file carving tool to recover MPEG-4 files an then use the methods above to search the recovered files.
download file now
alternative link download