Book Image

Practical Mobile Forensics - Second Edition

By : Heather Mahalik, Rohit Tamma, Satish Bommisetty
Book Image

Practical Mobile Forensics - Second Edition

By: Heather Mahalik, Rohit Tamma, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This book is an update to Practical Mobile Forensics and it delves into the concepts of mobile forensics and its importance in today's world. We will deep dive into mobile forensics techniques in iOS 8 - 9.2, Android 4.4 - 6, and Windows Phone devices. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from cloud, and document and prepare reports for your investigations. By the end of this book, you will have mastered the current operating systems and techniques so you can recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Practical Mobile Forensics - Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

Operating modes of iOS devices


Before we dive into the forensic techniques and acquisition methods, it is important to know the different operating modes of an iOS device. Many forensic tools and methods require you to place the device into one of the operating modes. Understanding the iOS device operating modes is required in order to perform a particular action on the device. While most commercial tools will demonstrate the proper steps to get the device into a particular mode, the examiner must understand what that mode represents. iOS devices are capable of running in different operating modes: the normal mode, recovery mode, and the DFU mode. Some forensic tools require the examiner to know which mode the device is currently utilizing. We will define each mode in this section.

Note

Note that when the term "iPhone" is mentioned, it should be understood that the statement remains true for all iOS devices.

The normal mode

When an iPhone is switched on, it is booted to its operating system...