Once you identified the specific model that you need to acquire, it becomes important to understand the best technique to use. The type of acquisition depends basically on the following five parameters:
- iOS version
- Passcode (not set, simple passcode, or complex passcode)
- Presence of a backup password
- Is the device jailbroken?
Nowadays, in the forensic community the following four techniques are used to access data stored on iDevices:
- Direct: This technique consists of a direct interaction with a powered on device through non-forensic software
- Backup or logical acquisition: This technique consists of a partial file system acquisition through the iTunes backup or using a forensic acquisition tool that uses the iTunes libraries ...