Data and application analysis
Publisher Summary
This chapter provides an overview of the analysis techniques that can be used on an image in order to recover the greatest amount of data possible. The directories and files in the device's file system are the primary focus of a forensic investigation. After performing a physical acquisition on an iOS device using one of the available methods, the resulting file will be in a disk image (.dmg) format. On a Mac, this file can be marked as read-only and mounted by double-clicking the file. By default, this should launch the DiskImageMounter on a Mac. File carving is a process in which specified file types are searched and extracted across binary data, often a forensic image of an entire disk ...
Get iPhone and iOS Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
