iOS Forensics for Investigators

Chapter 8: Email and Messaging Forensics

In the previous chapter, we discussed artifacts related to connectivity and learned how an investigator can leverage such data to understand who a user has been in contact with, how and when network data was used, and what websites the user visited. In this chapter, we will focus on email and messaging forensics.

Any investigation of a mobile device usually includes the search and analysis of messaging artifacts, as they can contain invaluable evidence: emails, text messages, and instant messaging can be used to transmit and receive all kinds of data, such as passwords, notes, confessions, threats, intellectual property, and multimedia files. In this chapter, we will learn where this evidence is stored, ...