The term file system acquisition was first introduced by Cellebrite, but has since been adopted by other commercial forensic tools and is sometime referred to as advanced logical acquisition. This method of acquisition enables the examiner to gain more data than obtained via a logical acquisition because it provides access to file system data. While this is not a substitute for a physical acquisition, it is the next best thing. For most iOS devices, which are not jailbroken, a file system image is the most data that we can obtain from the device using conventional methods.

This method of acquisition provides access to the user data partition only. The system partition of the device is only acquired via physical access. Should the device be jailbroken, additional data will be captured during the acquisition. Most tools offer one method to acquire the file system of an iOS device. Cellebrite offers between one and three methods, all of which differ per device. Method...