Chapter 10: Analyzing Third-Party Apps

The App Store, which was released in 2008, allows users to download third-party apps on their iOS devices. As of 2021, there were more than 4.5 million apps available for download. Once an app is available on the store, developers can publish updates containing bug fixes or new features that will automatically be installed on the device. This poses a problem from a forensic viewpoint, as many forensic tools aren't able to keep up with the speed at which apps are updated, while some applications are simply not supported altogether.

When a third-party application needs to be analyzed for an investigation, the examiner will most likely have to resort to manually researching, validating, and analyzing the artifacts, ...

Get iOS Forensics for Investigators now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.