Information Technology Reference
In-Depth Information
Chapter 4. Data Acquisition from iOS
Backups
The physical acquisition of an iPhone provides the most data in an investigation, but you
can also find a wealth of information on iPhone backups. iPhone users have several options
to back up data present on their devices. iPhone users can choose to back up data to their
computer using the
Apple iTunes
software or to the Apple cloud storage service known as
iCloud
. Every time an iPhone is synced with a computer or to iCloud, it creates a backup
by copying the selected files from the device. The user can determine what is contained in
the backup, so some may be more inclusive than others. Also, the user can back up to both
a computer and iCloud, and the data derived from each location may differ. Sometimes, the
best information available on an iOS device is recovered from a backup file.
In the previous chapter, we covered techniques to acquire data from an iPhone. This
chapter covers
backup file acquisition
techniques using Apple's synchronization protocol
from the device onto a computer or to iCloud.
Chapter 5
,
iOS Data Analysis and Recovery
,
will then teach you how to analyze the data pulled from
Chapter 3
,
Data Acquisition from
iOS Devices
, and
Chapter 4
,
Data Acquisition from iOS Backups
.
