iPhone Forensics

Index

A note on the digital index

A link in an index entry is displayed as the section title in which that entry appears. Because some sections have multiple index markers, it is not unusual for an entry to have several links to the same section. Clicking on any link will take you directly to the place in the text in which the marker appears.

A

access points

connecting to, Connecting to an Access Point

activating recovery toolkit, Step 4: Activate the Forensic Toolkit Payload

activation records

desktop trace, Activation Records–Activation Records

ad-hoc networks

connecting to, Creating an Ad-Hoc Network

address books

“deleted” entries, What’s Stored

electronic discovery, Address Book Contacts

admissibility of evidence, Rules of Evidence

AFC (Apple File Connection), Communication

AP isolation feature

configuring Wi-Fi and SSH, Connecting to an Access Point

authenticity of evidence, Rules of Evidence

automated bypass, Automated Bypass

B

backups

devices, Device Backups

believability of evidence, Rules of Evidence

binary property lists

electronic discovery, Binary Property Lists

booting

filesystem writes during, Power-On Device Modifications (Disclosure)

out of recover mode, Booting out of recovery mode

unsigned RAM disks, Source Code Examples

browser cache

recovery, What’s Stored

bypass passcode, Automated Bypass

bypassing SIM locks, Circumventing Passcode Protection (Firmware v1.0.2–1.1.4)

bytes

added to files during boot and login, Power-On Device Modifications (Disclosure)

C

calendar events

electronic discovery,