O'Reilly logo

Learning iOS Forensics - Second Edition by Pasquale Stirparo, Mattia Epifani

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Deleted data recovery

In this section, we will give you a quick overview on the difficulties of performing file carving operations on an iOS device and will help you understand why and what are the possibilities. We will also see the particular case of recovering the SQLite deleted records.

File carving - is it feasible?

Apple uses a technology called Data Protection in order to further protect data stored in flash memory on iDevices. Every time a file is created, a new 256-bit per-file key is generated and it is used to encrypt the file content using AES encryption. The per-file key is then wrapped with one of the data protection class keys and then stored in the file's metadata, which is in turn encrypted with the filesystem key (the EMF key

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required