We recommend treating all iOS devices the same. This means, do not try to handle jailbroken devices one manner and non-jailbroken in another manner. Essentially, try everything possible to gain access to that device. First, try a physical acquisition. If this method fails, attempt a file system acquisition, followed by a logical acquisition. If the device is locked and the passcode is required to acquire the device, attempt to crack it. The state of the iOS device should not keep you from trying your hardest to get a full physical image. For devices that are truly jailbroken, you will see how much easier this makes your life when attempting to acquire data.
There are several methods on both Mac and Windows platforms that support the acquisition of iOS devices. Earlier, we discussed the physical and file system section of this chapter; UFED Physical Analyzer offers additional support for jailbroken iOS devices. If the device is jailbroken, a physical acquisition...