Chapter 6. Mac and Windows Artifacts

In this book, we've put a lot of emphasis on the iPhone and not a lot on the data that could be left behind on a Mac or Windows computer. Most investigators forget to grab any Mac or Windows computers or to specify within their search warrants that important data is on the desktops; these computers can have historical data and passcode-bypass certificates. Not everyone syncs their iPod touch or iPhone as often as in the past, because more and more information is able to be added to these devices without ever syncing with a desktop computer. However, when a new update is released from Apple, Apple has made it necessary to connect to a computer and update the device. During the update process and without user ...

Get iOS Forensic Analysis for iPhone, iPad, and iPod touch now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.