Summary
The first step in a forensic examination of an iOS device should be identifying the device model. The model of an iOS device can be used to help the examiner develop an understanding of the underlying components and capabilities of the device, which can be used to drive the methods for acquisition and examination. Legacy iOS devices should not be disregarded because they may surface as part of an investigation. Examiners must be aware of all iOS devices as old devices are sometimes still in use and may be tied to a criminal investigation.
The next chapter will provide tools that will aid in obtaining data from iOS devices to later forensically examine. Not all tools are created equally, so it's important to understand the best tools to ...
Get Practical Mobile Forensics - Second Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
