Skip to Main Content
iPhone Forensics
book

iPhone Forensics

by Jonathan Zdziarski
September 2008
Intermediate to advanced content levelIntermediate to advanced
140 pages
3h 31m
English
O'Reilly Media, Inc.
Content preview from iPhone Forensics

Chapter 6. Desktop Trace

Recovering evidence from an iPhone can be an important step in building evidence for a case, but you can also find a wealth of information on any desktop machines that have been previously synced with the device. In a criminal investigation, a search warrant can be obtained to seize desktop equipment belonging to the suspect. In a corporate investigation, company-owned desktop or notebook machines can usually be examined.

The evidence found on a desktop or notebook computer can provide information about the trusted pairing relationship to the iPhone. The computer can also store backup copies of various data files, which are useful if the iPhone has been damaged or destroyed. This information can be used both as evidence and to further prove a relationship between the desktop and mobile device. If the suspect is trying to claim that the iPhone in evidence doesn’t belong to him, this is a great way to disprove it.

This book doesn’t cover desktop forensics, but assumes that the reader is familiar with desktop procedures. Most of the information gathered on the desktop can be found on the live filesystem, unless it has been deleted. Nonetheless, you should have a firm understanding of the procedures necessary to preserve evidence on the desktop, or the information you obtain may not be admissible. For more information about desktop forensics, check out File System Forensic Analysis by Brian Carrier (Addison-Wesley Professional).

A desktop trace should be gathered ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

iPhone and iOS Forensics

iPhone and iOS Forensics

Andrew Hoog, Katie Strzempka

Publisher Resources

ISBN: 9780596153588Supplemental ContentErrata Page