Book Image

Practical Mobile Forensics - Second Edition

By : Heather Mahalik, Rohit Tamma, Satish Bommisetty
Book Image

Practical Mobile Forensics - Second Edition

By: Heather Mahalik, Rohit Tamma, Satish Bommisetty

Overview of this book

Mobile phone forensics is the science of retrieving data from a mobile phone under forensically sound conditions. This book is an update to Practical Mobile Forensics and it delves into the concepts of mobile forensics and its importance in today's world. We will deep dive into mobile forensics techniques in iOS 8 - 9.2, Android 4.4 - 6, and Windows Phone devices. We will demonstrate the latest open source and commercial mobile forensics tools, enabling you to analyze and retrieve data effectively. You will learn how to introspect and retrieve data from cloud, and document and prepare reports for your investigations. By the end of this book, you will have mastered the current operating systems and techniques so you can recover data from mobile devices by leveraging open source solutions.
Table of Contents (19 chapters)
Practical Mobile Forensics - Second Edition
Credits
About the Authors
About the Reviewer
www.PacktPub.com
Preface

Summary


The first step in the iOS device forensic examination is to acquire the data from the device. There are several different ways to acquire data from an iOS device. This chapter covered physical, file system, and logical acquisition techniques, including techniques of acquiring jailbroken devices and methods to bypass passcodes using commercial, free, and hacker tools. Physical acquisition is the preferred acquisition method as it recovers as close as we can get to a bit-by-bit copy of the data from the device; however, it is not possible to perform physical acquisition on all iOS devices.

While physical acquisition is the best method for forensically obtaining a majority of the data from iOS devices, backup files may exist or be the only method to extract data from the device.

The next chapter discusses iOS device backup files in detail to include user, forensic, encrypted, and iCloud backup files, and the methods to conduct your forensic examination.