11   Advanced iOS Analysis

In 2014, the International Data Corporation (IDC) reported that Android and iOS mobile devices dominated the mobile market worldwide, with Android leading at a 76.6 percent share and Apple at 19.7 percent (www.idc.com/prodserv/smartphone-os-market-share.jsp). That leaves little doubt that these two types of devices also dominate the workload of most mobile device forensic examiners. This chapter deals specifically with the examination of the iOS file structure, which is available with a simple logical extraction or via a backup import created with iTunes.

Automated tools can be used to extract a lot of “tip of the iceberg” iOS device data, which satisfies many investigators. However, considering the total number of ...

Get Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.