The first step in iOS device forensic examination is to acquire the data from the device. There are several different ways to acquire data from an iOS device. This chapter covered logical, filesystem, and physical acquisition techniques, including techniques of acquiring jailbroken devices and methods to bypass passcodes. Physical acquisition is the preferred acquisition method as it recovers as close as we can get to a bit-by-bit copy of the data from the device; however, it is not possible to perform physical acquisition on all iOS devices.

While physical acquisition is the best method for forensically obtaining a majority of the data from iOS devices, backup files may exist or be the only method to extract data from the device.

The next chapter discusses iOS device backup files in detail, including user, forensic, encrypted, and iCloud backup files, and the methods to conduct your forensic examination.