The first step in the iPhone forensic examination is to acquire the data from the device. There are different ways to acquire data from an iPhone. This chapter covered physical acquisition techniques and techniques to bypass passcodes and data encryptions using open source methods. Physical acquisition is preferred as it recovers more data from the device; however, it is not possible to perform physical acquisition on all iOS devices. The following table summarizes the physical acquisition possibilities on iOS devices:

While physical acquisition is the best method for forensically obtaining the majority of the data from iOS devices, logical or backup files may exist or be the only method to extract data from the device. The next chapter...