iOS Forensic Analysis for iPhone, iPad, and iPod touch

Abstract

Trademarked names, logos, and images may appear in this book. Rather than use a trademark symbol with every occurrence of a trademarked name, logo, or image we use the names, logos, and images only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark.The use in this publication of trade names, trademarks, service marks, and similar terms, even if they are not identified as such, is not to be taken as an expression of opinion as to whether or not they are subject to proprietary rights.The information in this book is distributed on an "as is" basis, without warranty. Although every precaution has been taken in the preparation of this work, neither the author(s) nor Apress shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in this work. iii This book is dedicated to all those in uniform who serve our country and communities.They work tirelessly to keep us safe and go mostly unappreciated.

Using Smartphones as a Proxy for Forensic Evidence Contained in Cloud Storage Services

“…A recent study recovered more than 11,000 data artifacts from just 49, predominately low-end, devices [25]. As with a traditional mobile phone, the smartphone not only stores call logs, text messages and personal contacts, but it also has the ability to store web-browsing artifacts, email messages, instant messenger lots, GPS coordinates, as well as third-party application related data [26][27][28].…”

“…The following discussion concerns evidence found under this location. Hoog and Strzempka [37], as well as Morrissey discuss the iOS file system in further detail [28].…”

Event Reconstruction

“…Information left by browsers, temporary files or data stored in the memory of mobile devices offering social applications may be useful for investigators to obtain information about user contacts as well as his activity (Al Mutawa, Baggili, & Marrington, 2012) (e.g. sending date of a tweet on Twitter (Morrissey, 2010)). …”

Forensic investigation of social networking applications

“…The database stores data for each friend in the list including their names, ID numbers and phone number 25 . Twitter uses directories to store information about Twitter account data, attachments sent with Tweets, user names and date and time values 26 . MySpace uses an SQLite file to store the user name of the MySpace application, as well as comments that the user had posted along with timestamps 27 .…”