Book Image

iOS Forensics Cookbook

By : Bhanu Birani, Mayank Birani
Book Image

iOS Forensics Cookbook

By: Bhanu Birani, Mayank Birani

Overview of this book

Mobile device forensics is a branch of digital forensics that involves the recovery of evidence or data in a digital format from a device without affecting its integrity. With the growing popularity of iOS-based Apple devices, iOS forensics has developed immense importance. To cater to the need, this book deals with tasks such as the encryption and decryption of files, various ways to integrate techniques withsocial media, and ways to grab the user events and actions on the iOS app. Using practical examples, we’ll start with the analysis keychain and raw disk decryption, social media integration, and getting accustomed to analytics tools. You’ll also learn how to distribute the iOS apps without releasing them to Apple’s App Store. Moving on, the book covers test flights and hockey app integration, the crash reporting system, recovery tools, and their features. By the end of the book, using the aforementioned techniques, you will be able to successfully analyze iOS-based devices forensically.
Table of Contents (13 chapters)

Extracting and reading data

It is very important to understand the basics of the file system before you learn about the ways of extracting and reading data from the iOS device disk. All Apple operating systems use the same file system, hierarchical file system (HFS).

This file system works with the 512 byte-formatted block scheme. To categorize it further, these blocks are divided into two parts: allocation blocks and logical blocks. Logical blocks are available on the volume numbered from the first to the last block. These blocks remain static on the disk. Allocated blocks work with a different strategy; they can be grouped together to utilize the HFS more efficiently. The file structure includes the Allocation and Attributes Files, along with the Volume Header and Catalog Files, and so on.

Getting ready

To understand the extraction well, we will study a little about some of the headers of the HFS file system in detail.

The HFS+ Volume Header

For the HFS format disk, the boot blocks are sectors...