Practical Mobile Forensics - Third Edition

Data Acquisition from iOS Backups

In the previous chapter, we covered techniques to acquire data from an iOS device. This chapter covers techniques to acquire a backup of files from the device onto a computer or iCloud using Apple's synchronization protocol. 

The physical acquisition of an iOS device provides the most data in an investigation, but you can also find a wealth of information on iOS backups. iOS device users have several options to back up data present on their devices. Users can choose to back up data to their computer using the Apple iTunes software, or to the Apple cloud storage service known as iCloud. Every time an iPhone is synced with a computer or to iCloud, it creates a backup by copying the selected files from the device. ...