iDevices come with some native applications already installed by Apple, such as Safari browser, e-mail client, calendar, and utilities linked to some basic phone functionalities, such as the Camera, Call History, or the SMS/iMessage. Most of the evidence produced by these native applications and functionalities are located, other than in the application folders themselves, in the
/private/var/mobile/Library/: In case of physical acquisition or inside the device
Backup Service/mobile/Library/: In case of filesystem acquisition
Library: In case of logical acquisition
Here, we can find data related to communication, preferences, Internet history and cache, keyboard keystrokes, and much more. Other than the
Library folder, ...