iPhone Forensics

Good Forensic Practices

As you practice the techniques in this book, keep the following in mind.

Preserve the Evidence

Never work on original copies of evidence. As soon as you recover evidence, create a read-only master copy and check it into a digital vault. All further processing should be performed on copies of the evidence. Since you’re dealing with digital evidence, and not old 8-tracks, the copies you make will be identical to the masters. Some tools, if not used properly, can make modifications to the data that’s being operated on.

In addition to this, never run any applications on the device until after you’ve recovered and checked in the evidence. Any time you use the device, something on the disk is likely to be changed. Perform only the tasks that are absolutely necessary, and keep your intrusion into the system minimal.

Document the Evidence

Whenever a master copy is made, use a cryptographic digest such as MD5 to ensure the evidence hasn’t been altered in any way. Digests should be stored separately from the data itself, so as to make it even more difficult to tamper with. Digests and proper documentation will help ensure that no cross-contamination has taken place.

In addition to this, document all of the methods you used to collect and extract the evidence. Detail your notes enough that another examiner could reproduce them. This isn’t a rule of thumb, but rather is required in many cases. Your work must be reproducible should another forensic examiner challenge your evidence. ...