iPhone Forensics

Employee Destroyed Important Data

On the iPhone, important data can be photos, email, a PDF, or other stored information. Simple information, such as a boarding pass number, can be of great importance if stored somewhere in the browser cache. Data can be destroyed intentionally or by accident, but in either case it’s important to understand how to properly recover the lost data. Chapter 4 introduced you to Scalpel, a data-carving tool, which can recover deleted files from a disk image based on the file’s header (and optionally, footer). Become intimately familiar with Scalpel, as it is critical for recovering deleted information.

To recover deleted files, Scalpel requires a file header. This represents the first few bytes of the file that can be used to identify the kind of data you’re trying to recover. Many examples were given in Chapter 4 to recover some types of proprietary files from the iPhone. Your first attempt at recovering the missing files is to run Scalpel with the rules from Chapter 4.

In the event that some of the data was damaged, it may still be possible to recover pieces of the missing files from the device, especially if they were unstructured communication.

Email

If part of the message was deleted, you may be able to scan for other parts of the message, such as “Subject: ” or a message boundary. Using another message from the same sender, examine the message’s source to find the type of message boundary it uses. Some mail agents will use the text NEXTPART followed ...