Practical Mobile Forensics - Third Edition

Key artifacts – important iOS database files

Raw disk images, filesystems and logical dumps, and the backup that you extracted as per the instructions in Chapter 3, Data Acquisition from iOS Devices and Chapter 4, Data Acquisition from iOS Backups, should contain the following SQLite databases that may be important to your investigation. Should these files not be recovered, make sure that you acquired the iOS device correctly. The files that are shown in the following sections are extracted from an iOS 11 device. As Apple adds new features to the built-in applications with every iOS release, the format of the files may vary for different iOS versions. More information regarding important database files can be found at https://digital-forensics.sans.org/media/for585-poster.pdf. ...