Information Technology Reference
In-Depth Information
Summary
This chapter covered various data analysis techniques and specified the locations of data
within the iOS device's file system. We also explained most of the common file formats
used in the iPhone and walked you through important files to recover the most data pos-
sible. Most open source and commercial tools are able to pull deleted data from common
database files, such as contacts, calls, SMS, and more, but they often overlook the third-
party application database files. We covered techniques to recover deleted SQLite records
that prove useful in most iOS device investigations. Again, the acquisition method, encod-
ing, and encryption schemas can affect the amount of data you can recover during your ex-
amination. In the next chapter, we will discuss iOS forensic tools, which will help you ac-
quire and analyze data.
