Book Image

Practical Mobile Forensics - Second Edition

By : Heather Mahalik, Rohit Tamma, Satish Bommisetty
Book Image

Practical Mobile Forensics - Second Edition

By: Heather Mahalik, Rohit Tamma, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This book is an update to Practical Mobile Forensics and it delves into the concepts of mobile forensics and its importance in today's world. We will deep dive into mobile forensics techniques in iOS 8 - 9.2, Android 4.4 - 6, and Windows Phone devices. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from cloud, and document and prepare reports for your investigations. By the end of this book, you will have mastered the current operating systems and techniques so you can recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Practical Mobile Forensics - Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

The Apple Watch


Examining the Apple Watch is new and exciting. The good news is that the files found on the watch are similar, if not the same as those found on the iPhone. We are going to see the data primarily existing in the SQLite database and plist files, and this is examined by creating or examining an iPhone backup file. Remember that an iPhone running iOS 8.2 or later is the only iOS device capable of being linked to the Apple Watch.

One unique aspect about the Apple Watch is that the data pertaining to the watch is stored in the mobile/Library/DeviceRegistry directory within the backup, which is shown in the following screenshot:

The Apple Watch data directory

Here, you will find exact copies of files found on the iPhone. If the case relies upon determining what happened on the Apple Watch versus the iPhone, it may be impossible to solve. As of Watch 2.0, the files that are used by both the iPhone and the watch are exact copies of one another, and they do not contain status flags stating...