Summary

This chapter covered various data analysis techniques and specified the locations of data within the iOS device's file system. We also explained most of the common file formats used in the iPhone and walked you through important files to recover the most data possible. Most open source and commercial tools are able to pull deleted data from common database files, such as contacts, calls, SMS, and more, but they often overlook the third-party application database files. We covered techniques to recover deleted SQLite records that prove useful in most iOS device investigations. Again, the acquisition method, encoding, and encryption schemas can affect the amount of data you can recover during your examination. In the next chapter, we will discuss iOS forensic tools, which will help you acquire and analyze data.