11   Advanced iOS Analysis

In 2014, the International Data Corporation (IDC) reported that Android and iOS mobile devices dominated the mobile market worldwide, with Android leading at a 76.6 percent share and Apple at 19.7 percent (www.idc.com/prodserv/smartphone-os-market-share.jsp). That leaves little doubt that these two types of devices also dominate the workload of most mobile device forensic examiners. This chapter deals specifically with the examination of the iOS file structure, which is available with a simple logical extraction or via a backup import created with iTunes.

Automated tools can be used to extract a lot of “tip of the iceberg” iOS device data, which satisfies many investigators. However, considering the total number of ...

Get Mobile Forensic Investigations: A Guide to Evidence Collection, Analysis, and Presentation now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.