January 2018
Beginner to intermediate
402 pages
10h 6m
English
book
Practical Mobile Forensics - Third Edition
by Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Content preview from Practical Mobile Forensics - Third Edition
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
The filesystem
To better understand the forensic process of an iOS device, it is good to know about the filesystem that is used. The filesystem used in the iPhone and other Apple iOS devices is HFSX, a variation of HFS Plus with one major difference. HFSX is case-sensitive whereas HFS Plus is case-insensitive. Other differences will be discussed later in this chapter. OS X uses HFS Plus by default and iOS uses HFSX. Apple File System (APFS) was introduced in June 2016 as a replacement for HFS+, and released for iOS devices with the release of iOS 10.3, and for macOS devices with the release of macOS 10.13.