iPhone Forensics

Cross-Contamination and Syncing

The last thing you should know before you get started is that the iPhone likes to sync data, and this can present a risk of cross-contamination. When the iPhone syncs to a desktop, it can copy the desktop’s address book, photos, music, and other data. The desktop can also copy its own data back to the iPhone. Therefore, before performing any of the steps in the coming chapters, be sure to disable all automatic syncing in order to keep the iPhone’s current data pristine:

1. Open iTunes on the desktop machine.

2. Select Preferences from the iTunes menu.

3. Click on the Syncing tab.

4. Check the box next to “Disable automatic syncing for all iPhones and iPods.” This is illustrated in Figure 2-1.

Figure 2-1. iTunes preferences with automatic syncing disabled

Note

As an alternative, consider using a bootable CD or virtual machine to perform the recovery steps outlined throughout the rest of this book.

In addition to this procedure, it’s also a good idea to conduct all of your forensic recovery and examination using a desktop machine with a separate user account for each case. Think of a user account as an “evidence box”—you wouldn’t consider putting evidence from two different cases in the same box! Ensure that you have created and are logged into a separate, nonprivileged user account. When using Mac OS X, the user account may also be encrypted with file vault to prevent cross-contamination ...