Chapter 5. Acquisitions
Information in this chapter:
• iPhone Forensics Overview
• Imaging other Apple Devices
This chapter covers the various types of forensic acquisitions that can be performed on the iPhone, iPad, and other iOS devices. The importance of forensic imaging is discussed, followed by the different ways in which a device can be imaged. Two different methods of data retrieval through the iPhone's backup files are explained in detail, followed by a logical acquisition and, finally, a physical extraction of the device. The possibility of imaging other iOS devices, including the iPod Touch and Apple TV, is also outlined.
Keywords: Forensic acquisition, iPhone backup, logical acquisition, physical acquisition, Zdziarski ...