The physical acquisition of an iPhone provides the most data in an investigation, but you can also find a wealth of information on iPhone backups. iPhone users have several options to back up data present on their devices. iPhone users can choose to back up data to their computer using the Apple iTunes software or to the Apple cloud storage service known as iCloud. Every time an iPhone is synced with a computer or to iCloud, it creates a backup by copying the selected files from the device. The user can determine what is contained in the backup, so some may be more inclusive than others. Also, the user can back up to both a computer and iCloud, and the data derived from each location may differ. Sometimes, the best information available on an iOS device is recovered from a backup file.

In the previous chapter, we covered techniques to acquire data from an iPhone. This chapter covers backup file acquisition techniques using Apple's synchronization...