Practical Mobile Forensics - Second Edition

Summary

The first step in the iOS device forensic examination is to acquire the data from the device. There are several different ways to acquire data from an iOS device. This chapter covered physical, file system, and logical acquisition techniques, including techniques of acquiring jailbroken devices and methods to bypass passcodes using commercial, free, and hacker tools. Physical acquisition is the preferred acquisition method as it recovers as close as we can get to a bit-by-bit copy of the data from the device; however, it is not possible to perform physical acquisition on all iOS devices.

While physical acquisition is the best method for forensically obtaining a majority of the data from iOS devices, backup files may exist or be the only ...