In this chapter, we'll refer to logical acquisition in the sense of acquiring and analyzing iTunes backups. Every time an iPhone user syncs their device with a PC (Windows or macOS X), iTunes creates a local copy of all user data stored in the device (unless the user opts for cloud backups, which will be covered in the next chapter). While it is arguable whether automated backups with no user intervention are a good thing or a bad thing, unless a cloud option is selected, users end up having backup copies of their device contents on every computer they sync with.
As a result, the chance of encountering a local copy of an iPhone on the user's PC is not insignificant. By default, iTunes stores offline backups in the following folders on the user's computer:
macOS X:
~/Library/Application Support/MobileSync/Backup/
Windows XP:
Documents and Settings\(username)\Application Data\Apple Computer\MobileSyncBackup
Windows Vista, Windows 7, 8, and 8.1...