Book Image

iOS Forensics for Investigators

By : Gianluca Tiepolo
5 (1)
Book Image

iOS Forensics for Investigators

5 (1)
By: Gianluca Tiepolo

Overview of this book

Professionals working in the mobile forensics industry will be able to put their knowledge to work with this practical guide to learning how to extract and analyze all available data from an iOS device. This book is a comprehensive, how-to guide that leads investigators through the process of collecting mobile devices and preserving, extracting, and analyzing data, as well as building a report. Complete with step-by-step explanations of essential concepts, practical examples, and self-assessment questions, this book starts by covering the fundamentals of mobile forensics and how to overcome challenges in extracting data from iOS devices. Once you've walked through the basics of iOS, you’ll learn how to use commercial tools to extract and process data and manually search for artifacts stored in database files. Next, you'll find out the correct workflows for handling iOS devices and understand how to extract valuable information to track device usage. You’ll also get to grips with analyzing key artifacts, such as browser history, the pattern of life data, location data, and social network forensics. By the end of this book, you'll be able to establish a proper workflow for handling iOS devices, extracting all available data, and analyzing it to gather precious insights that can be reported as prosecutable evidence.

Related Content you might be interested in

Current Title:

Small book image
iOS Forensics for Investigators
Gianluca Tiepolo
May, 2022 | 316 pages
Small book image
Practical Mobile Forensics
Heather Mahalik | Rohit Tamma | Oleg Skulkin | Satish Bommisetty
Apr, 2020 | 400 pages
Small book image
Practical Mobile Forensics
Heather Mahalik | Rohit Tamma | Oleg Skulkin | Satish Bommisetty
Jan, 2018 | 402 pages
Small book image
Mobile Forensics Cookbook
Igor Mikhaylov
Dec, 2017 | 302 pages
Table of Contents (17 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Download the color images
Conventions used
Disclaimer
Get in touch
Share Your Thoughts
1
Section 1 – Data Acquisition from iOS Devices
Section 1 – Data Acquisition from iOS Devices
Free Chapter
2
Chapter 1: Introducing iOS Forensics
Chapter 1: Introducing iOS Forensics
Understanding mobile forensics
Dissecting the iOS operating system
Understanding iOS security
Establishing a workflow
Summary
3
Chapter 2: Data Acquisition from iOS Devices
Chapter 2: Data Acquisition from iOS Devices
Understanding acquisition methods
Jailbreaking the device
Triaging the device
Performing a logical acquisition
Performing a filesystem acquisition
Summary
4
Section 2 – iOS Data Analysis
Section 2 – iOS Data Analysis
5
Chapter 3: Using Forensic Tools
Chapter 3: Using Forensic Tools
Understanding forensic tools
Working with Cellebrite Physical Analyzer
Working with Magnet AXIOM
Using open source tools
Summary
6
Chapter 4: Working with Common iOS Artifacts
Chapter 4: Working with Common iOS Artifacts
Understanding the importance of validation
Working with iOS artifacts
Locating common artifacts
Summary
7
Chapter 5: Pattern-of-Life Forensics
Chapter 5: Pattern-of-Life Forensics
Introducing pattern-of-life forensics
Working with timestamps
Logs, events, and user interaction
Introducing Apollo
Summary
8
Chapter 6: Dissecting Location Data
Chapter 6: Dissecting Location Data
Introducing location data
GPS fixes, cell towers, and Wi-Fi networks
Locating location artifacts
Analyzing location data using forensic tools
Summary
9
Chapter 7: Analyzing Connectivity Data
Chapter 7: Analyzing Connectivity Data
Introducing cellular forensics
Analyzing networking data
Introducing Bluetooth forensics
Understanding Safari forensics
Summary
10
Chapter 8: Email and Messaging Forensics
Chapter 8: Email and Messaging Forensics
Introducing email forensics
Understanding messaging forensics
Introducing third-party messaging apps
Recovering deleted messages
Summary
11
Chapter 9: Photo, Video, and Audio Forensics
Chapter 9: Photo, Video, and Audio Forensics
Introducing media forensics
Analyzing photos and videos
Introducing EXIF metadata
Analyzing user viewing activity
Summary
12
Chapter 10: Analyzing Third-Party Apps
Chapter 10: Analyzing Third-Party Apps
Introducing iOS applications
Dynamic application analysis
Practical third-party applications forensics
Summary
13
Chapter 11: Locked Devices, iTunes Backups, and iCloud Forensics
Chapter 11: Locked Devices, iTunes Backups, and iCloud Forensics
Acquiring locked devices
BFU acquisition of locked devices
Introducing iTunes backups
Introducing iCloud forensics
Summary
14
Section 3 – Reporting
Section 3 – Reporting
15
Chapter 12: Writing a Forensic Report and Building a Timeline
Chapter 12: Writing a Forensic Report and Building a Timeline
Mobile forensics reporting
Creating reports using Cellebrite Physical Analyzer
Introducing timelines
Building a timeline with Magnet AXIOM
Summary
Why subscribe?
16
Other Books You May Enjoy
Other Books You May Enjoy
Packt is searching for authors like you
Share Your Thoughts

Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "We're providing a ZIP archive as the input file and we're exporting the report to the output folder."

A block of code is set as follows:

SELECT ROWID, text FROM message
ORDER BY ROWID DESC
LIMIT 5;

Any command-line input or output is written as follows:

python3 ileapp.py -t zip -i ../iphone_dump.zip -o output

Bold: Indicates a new term, an important word, or words that you see onscreen. For example, words in menus or dialog boxes appear in the text like this. Here is an example: "Once you've added all evidence sources to the case, click on GO TO PROCESSING DETAILS to continue."

Tips or Important Notes

Appear like this.

Previous Section
Next Section