Forensics

So far, we've discussed looking at data on devices. When you use a device, unless you made a forensic image of the device prior to using it, you are tainting evidence. This is not a book on forensics, but we can let you know about some tools that will allow you to acquire a forensically sound image of a device without much fanfare.

Note

Many of these tools are only available to law enforcement professionals. Apple has recently gone to great lengths to make their devices "leak" less data, even to law enforcement. Since iOS 7, it's been practically impossible to brute force passcodes and after Apple fixed the bootroom exploits of iPhone 4/iPad 2, it's no longer possible to obtain an image of the device's flash storage for offline analysis.

The following links are available to help you properly acquire evidence from iOS devices and computers that access iOS devices:

• iOS Forensic Toolkit: http://www.elcomsoft.com/eift.html

• Mobilyze: https://www.blackbagtech.com/mobilyze.html

• Access Data...