Information Technology Reference
In-Depth Information
Summary
The first step in a forensic examination of an iOS device should be identifying the device
model. The model of an iOS device can be used to help the examiner develop an under-
standing of the underlying components and capabilities of the device, which can be used to
drive the methods for acquisition and examination. Legacy iOS devices should not be dis-
regarded because they may surface as part of an investigation. Examiners must be aware of
all iOS devices as old devices are sometimes still in use and may be tied to a criminal in-
vestigation. The next chapter will provide tips and techniques for acquiring data from the
iOS devices discussed in this chapter.
