Practical Mobile Forensics - Third Edition

Summary

Forensic tools are helpful for an examiner as they not only save time, but also make the process a lot easier. However, not everyone has a budget large enough to purchase commercial tools to obtain iOS acquisition. While free tools exist for acquisition, support may be limited and multiple extractions may be required to obtain the same amount of data as a commercial tool.

For jailbroken devices, the iOS device could be connected to a Mac for live examination through SSH, which is how some of the tools acquire the data. However, this is not a method that is recommended for those new to digital forensics. For such purposes, this chapter introduced you to several available iOS forensic tools and included the steps to perform acquisition ...