Advanced logical acquisition and analysis with Cellebrite UFED Physical Analyzer

As we mentioned previously, Physical Analyzer can be used not only for parsing different types of forensic artifacts from acquired images but also for performing both logical and filesystem (and even physical, for older devices) types of extraction from iOS devices. Due to the fact that physical acquisition is actually only for older devices, the best option is an advanced logical acquisition.

We are going to acquire and analyze data from an iPhone running iOS 13.2.3. Let's get started:

  1. Connect the device through the appropriate cable to your workstation. Make sure it's trusted and launch the Physical Analyzer.
  1. Go to Extract | iOS Device Extraction. The ...

Get Practical Mobile Forensics - Fourth Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.