iPhone Forensics

Technical Processes

This book covers the following key technical processes:

Physical handling

The physical handling of the device, prior to its examination. This includes dusting for prints and ensuring you have the right equipment to keep the device charged and connected. You’ll also want to remove the SIM card from the device or place the device in a Faraday cage. A Faraday cage is a shielded enclosure that blocks electrical fields, including cellular transmissions.

Establishing communication

Unlike a desktop machine, where the hard disk can be removed, mobile devices cannot generally be image-processed unless you have special equipment to perform chip dumps. As a result, the device must be “talked to” in order to recover evidence. Establishing communication with the device means setting up the proper physical and network connections to install a forensic toolkit and perform recovery.

Forensic recovery

The recovery process involves extracting the evidence from the device to create a master copy. This requires special integrity checks to ensure the data hasn’t changed between the iPhone and the desktop.

Electronic discovery

Electronic discovery is the process by which the evidence is processed and analyzed. During this stage, deleted files are recovered and the live filesystem is analyzed. The evidence discovered here will ultimately build an explanation of the evidence that will be delivered through an attorney.