iPhone Forensics

Chapter 1. Introduction to Computer Forensics

Forensic science dates back as early as the second century B.C., to Archimedes. Its most modern roots came from the mid to late 1800s, from a man named Henry Faulds. Faulds was a Scottish doctor, archaeologist, and missionary. Discovering fingerprints that had been left in ancient pottery, Faulds published a paper in 1880 suggesting that fingerprints could be used to uniquely identify criminals. This dovetailed the work of William J. Herschel, a British officer stationed in India, who had previously been using fingerprints and handprints as a means of identification on legal notes.

Modern day forensics can be described as the fusion of methodology and science, as it applies to the scientific process of documenting an event or an artifact. As it pertains to criminal and civil court cases, the science and methodology that is performed must adhere to rules of evidence and practices generally accepted within the given legal jurisdiction.

Computer forensics is a branch of forensic science involving the application of science and methodology to preserve, recover, and document electronic evidence. Instead of dealing with dead bodies, examiners in this field deal with dead hard drives. As it pertains to the iPhone, your challenge is even greater in that you will be examining an embedded device, which has been intentionally closed off and was not intended for recovery.

Making Your Search Legal

Before getting started, it’s important to emphasize the ...