Preface

Over the past few years, digital forensic examiners have seen a remarkable increase in requests to extract and analyze data from iOS and Android mobile devices. Smartphones and the rich data associated with them have become the single most important source of evidence in virtually every type of investigation. The examination and extraction of data from these devices present numerous unique challenges: modern devices contain so much data that it takes someone with training and experience to add context to the data and understand where that data comes from, how it was generated, and what it means for the investigation.

Finding artifacts on a mobile device is the easy part but recognizing whether those artifacts are evidence can be much harder. Too often, mobile examiners rely on automated tools to extract and process the data, simply allowing the software to identify it without completely comprehending how the actual file that contains this data was created, what it means, and what is going on behind the scenes. Forensic tools and commercial software definitely have their place, but they're not enough. The modern investigator needs to take an in-depth look at the artifacts and learn how to recognize which artifacts are potentially evidence and which are just noise.

Most technical books tend to be tool-focused and often take on a cookbook approach to mobile forensics. This book takes a completely different approach, by guiding you through logical steps that explain what's going on behind the scenes and how to interpret the data. By the end of this book, the examiner will be able to collect the data from an iOS device using multiple techniques and demonstrate unequivocally where the data came from and what it entails for the investigation.