Information Technology Reference
In-Depth Information
Chapter 3. Data Acquisition from iOS
Devices
An iPhone recovered from a crime scene can provide a rich source of evidence due to its
increased storage capabilities and Internet connectivity. According to several news referen-
ces, Ocsar Pistorius' iPads were examined by a mobile expert and presented during the
murder trial to show Internet activity hours before the murder of his girlfriend. There are
different ways to acquire forensic data from an iPhone. Though each method will have its
positives and negatives, the fundamental principle of any acquisition method is to obtain a
bit-by-bit picture of the original data.
This chapter covers physical acquisition techniques that target the physical storage medium
directly and extract a disk image from the device into an external file, which can be ex-
amined later using forensic tools.
