Understanding the Internals of iOS Devices - Practical Mobile Forensics - page 43

available and will be discussed in Chapter 3 , Data Acquisition from iOS Devices , and
Chapter 4 , Data Acquisition from iOS Backups .
Before examining an iPhone, it is necessary to identify the correct hardware model and
the firmware version installed on the device. Knowing the iPhone details helps you to un-
derstand the criticalities and possibilities of obtaining evidence from the iPhone. For ex-
ample, in many cases, the device passcode is required in order to obtain the file system or
logical image. Depending on the iOS version, device model, and passcode complexity, it
may be possible to obtain the device passcode using a brute force attack.
There are various ways to identify the hardware of a device. The easiest way to identify
the hardware of a device is by observing the model number displayed on the back of the
device. The following image shows the model number etched on the back of the casing.
Apple's knowledge base articles can be helpful for this purpose. Details on identifying
iPhone models can be found at http://support.apple.com/kb/HT3939 .
iPhone model number located on the back of the case
The firmware version of an iPhone can be found by accessing the Settings option and
then navigating to General | About | Version , as shown in the following screenshot. The
purpose of the firmware is to enable certain features and assist with the general function-
ing of the device.
The iPhone About screen, displaying firmware Version 5.1.1 (9B206)