Data Acquisition from iOS Backups - Practical Mobile Forensics - page 113

iTunes backup
A wealth of information is stored on any computer that has been previously synced with an
iPhone. These computers, commonly referred to as host computers, can have historical data
and passcode-bypass certificates. So, in a criminal investigation, a search warrant can be
obtained to seize a computer that belongs to the suspect. iOS backup file forensics mainly
involve analyzing an offline backup produced by an iPhone. However, the iTunes backup
method is also useful in cases when physical acquisition of a device is not feasible. In this
situation, examiners essentially create an iTunes backup of the device and analyze it using
forensic software. Thus, it is important for an examiner to completely understand the
backup process and the tools involved.
iPhone backup files can be created using the iTunes software, which is available for MAC
OS X and Windows platforms. iTunes is a free utility provided by Apple for data syn-
chronization and management between the iPhone and the computer. iTunes uses Apple's
proprietary synchronization protocol to copy data from the iPhone to a computer. An
iPhone can be synced with a computer using a USB or Wi-Fi. iTunes provides an option for
encrypted backup, but by default it creates an unencrypted backup whenever an iPhone is
synced. The backup copies of the iPhone can also be useful to recover data if the phone is
lost or damaged.
iTunes is configured to automatically initiate the synchronization process once the iPhone
is connected to the computer. To avoid unintended data exchange between the iPhone and
the computer, disable the automatic synchronization process before connecting your iPhone
to the forensic workstation. The following screenshot illustrates the option that disables
automatic syncing in iTunes Version 11.1.3.
To disable auto-syncing in iTunes, perform the following steps:
1. Navigate to iTunes | Preferences | Devices .
2. Check Prevent iPods, iPhones and iPads from syncing automatically and click
on the OK button.