Practical Mobile Forensics - Third Edition
by Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Key artifacts – important iOS database files
Raw disk images, filesystems and logical dumps, and the backup that you extracted as per the instructions in Chapter 3, Data Acquisition from iOS Devices and Chapter 4, Data Acquisition from iOS Backups, should contain the following SQLite databases that may be important to your investigation. Should these files not be recovered, make sure that you acquired the iOS device correctly. The files that are shown in the following sections are extracted from an iOS 11 device. As Apple adds new features to the built-in applications with every iOS release, the format of the files may vary for different iOS versions. More information regarding important database files can be found at https://digital-forensics.sans.org/media/for585-poster.pdf. ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access