Goal: Extracting data and artifacts from the backup without altering any information. Backups shown in the article are captured using iTunes 10.6. Note: iPhone 4 GSM model with iOS 5.0.1 is used for the demos. So, gaining access to the computer’s file system will also give access to the mobile devices’ data. When a computer is used to sync with the iPhone, most of the information on the iPhone is likely to be backed up onto the computer. Understanding the forensics techniques on iTunes backups is also useful in cases where we get physical access to the suspect’s computer instead of the iPhone directly. This article explains the technical procedure and challenges involved in extracting data and artifacts from the iPhone backups. iTunes uses AFC (Apple file connection) protocol to take the backup and also the backup process does not modify anything on the iPhone except the escrow key records. In critical cases, forensic examiners rely on analyzing the iPhone logical backups acquired through iTunes.
Forensic analysis on a live device reboots the phone and may alter the information stored on the device. This Previous article on iPhone forensics detailed the forensic techniques and the technical challenges involved in performing live device forensics.
IPhone forensics can be performed on the backups made by iTunes or directly on the live device.
Interested in formal iPhone forensics course? Check out our 3 day iPhone and iOS forensics training now available.
0 kommentar(er)
