Practical Mobile Forensics - Fourth Edition

Summary

Forensic tools are helpful for an examiner as they not only save time but also make the process a lot easier. However, not everyone has a budget large enough to purchase commercial tools to obtain iOS acquisition. While free tools exist for acquisition, support may be limited and multiple extractions may be required to obtain the same amount of data as a commercial tool.

For jailbroken devices, the iOS device can be connected to a forensic workstation for live examination through SSH, which is how some of the tools acquire the necessary data. However, this is not a method that is recommended for those new to mobile forensics. For such purposes, this chapter introduced you to several available iOS forensic tools and included the steps ...