Practical Mobile Forensics - Second Edition

File system acquisition

The term file system acquisition was first introduced by Cellebrite, but has since been adopted by other commercial forensic tools and is sometime referred to as advanced logical acquisition. This method of acquisition enables the examiner to gain more data than obtained via a logical acquisition because it provides access to file system data. While this is not a substitute for a physical acquisition, it is the next best thing. For most iOS devices, which are not jailbroken, a file system image is the most data that we can obtain from the device using conventional methods.

This method of acquisition provides access to the user data partition only. The system partition of the device is only acquired via physical access. Should ...