iOS Forensics for Investigators

Chapter 3: Using Forensic Tools

In the previous chapter, we learned all about the different acquisition techniques and how to use forensic tools to extract data from iOS devices. In this chapter, we will learn which are the most popular tools for data analysis, and their features and limitations.

Although using forensic tools for data analysis is not strictly required since theoretically it is possible to examine files manually, using these tools has many advantages. The most evident benefit of using forensic tools compared to manually parsing artifacts is time: if used correctly, these tools are huge time savers as they're programmed to automatically search for relevant files, look for patterns, analyze known data structures, and extract meaningful ...