File system acquisition
The term file system acquisition was first introduced by Cellebrite, but has since been adopted by other commercial forensic tools and is sometime referred to as advanced logical acquisition. This method of acquisition enables the examiner to gain more data than obtained via a logical acquisition because it provides access to file system data. While this is not a substitute for a physical acquisition, it is the next best thing. For most iOS devices, which are not jailbroken, a file system image is the most data that we can obtain from the device using conventional methods.
This method of acquisition provides access to the user data partition only. The system partition of the device is only acquired via physical access. Should ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access