Chapter 3. Data Acquisition from iOS Devices

An iPhone recovered from a crime scene can provide a rich source of evidence due to its increased storage capabilities and Internet connectivity. According to several news references, Ocsar Pistorius' iPads were examined by a mobile expert and presented during the murder trial to show Internet activity hours before the murder of his girlfriend. There are different ways to acquire forensic data from an iPhone. Though each method will have its positives and negatives, the fundamental principle of any acquisition method is to obtain a bit-by-bit picture of the original data.

This chapter covers physical acquisition techniques that target the physical storage medium directly and extract a disk image from the device into an external file, which can be examined later using forensic tools.