The one way we studied is forensic examination using physical acquisition and the other way is to perform forensic examination on data backups. This method is very feasible when a device is not accessible. The Apple mobile users have the option to keep a complete backup of the device on a computer or iCloud using iTunes. The user can also specify what to include in backups.
The computer on which the iPhone backups are synced will contain a wealth of information about the user's device. Therefore, a search warrant can be obtained to seize a computer on which the data backups are kept.
When you connect your iPhone to the computer, iTunes starts by default and initiates the synchronization process as follows:
Follow the steps to disable the auto sync option in iTunes:
Navigate to iTunes...