A wealth of information is stored on any computer that has been previously synced with an iPhone. These computers, commonly referred to as host computers, can have historical data and passcode-bypass certificates. So, in a criminal investigation, a search warrant can be obtained to seize a computer that belongs to the suspect. iOS backup file forensics mainly involve analyzing an offline backup produced by an iPhone. However, the iTunes backup method is also useful in cases when physical acquisition of a device is not feasible. In this situation, examiners essentially create an iTunes backup of the device and analyze it using forensic software. Thus, it is important for an examiner to completely understand the backup process and the tools involved.

iPhone backup files can be created using the iTunes software, which is available for MAC OS X and Windows platforms. iTunes is a free utility provided by Apple for data synchronization and management between the iPhone and the computer...