Chapter 3. iOS Forensic Tools

The examiner must not only know how to use forensic tools, but must understand the methods and acquisition techniques deployed by the tools they use in their investigations. Forensic tools not only save time but also make the process a lot easier. However, each tool has its flaws, and the examiner must catch mistakes and know how to correct them by leveraging another tool or technique. It's impossible for a tool to support all devices, and the examiner is responsible for learning and using the best tools to complete the job. As discussed in the last chapter, the examiner must understand how data is stored on iOS devices to ensure that the tool is capturing all accessible data. Without an expectation of what your forensic ...

Get Practical Mobile Forensics - Second Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.