iOS Forensics for Investigators

Chapter 7: Analyzing Connectivity Data

In the previous chapter, we introduced location-related artifacts and learned how an investigation can leverage such data to obtain a general geographical location of where the device may have been. In this chapter, we will focus on connectivity data.

The modern mobile phone has evolved from being a simple handheld device that's used to communicate via voice into a mobile computing device that communicates with the internet. Almost every interaction between a device and the external world is logged by the operating system, so it shouldn't come as a surprise that connectivity data has become the single most important source of evidence in virtually every type of investigation: artifacts such as call logs ...