Information Technology Reference
In-Depth Information
Chapter 5. iOS Data Analysis and
Recovery
A key aspect in iPhone forensics is to examine and analyze the data acquired from an
iPhone to interpret the evidence. Data on most iOS devices is encrypted and requires that
the data partition be decrypted prior to an examination. In the previous chapters, you
learned various techniques to acquire data from an iPhone. The raw disk image obtained
during physical acquisition, the file system dump or the logical/backup file contains hun-
dreds of data files. This chapter will help you to understand how data is stored on the
iPhone and will walk you through the important files in order to recover the most data pos-
sible.
