iOS backup parsing with UFED Physical Analyzer
UFED Physical Analyzer is a tool that is provided together with Cellebrite products such as UFED 4PC, UFED Touch, UFED Touch 2, UFED UME-36, and so on. Using this tool, you can analyze the following extracted data: physical dumps, backups, and filesystems of mobile devices, and also you can extract data from Apple mobile devices and from GPS/mass storage devices. UFED Physical Analyzer includes SQLite Wizard, which we described in Chapter 7, Understanding Plist Forensics.
Getting ready
You can request a trial license of UFED Physical Analyzer from Cellebrite distributors. In response to the request, you will receive an email with links to the distribution kits. Download UFED Physical Analyzer. Double-click the icon for the setup file of the program. Follow the instructions to install UFED Physical Analyzer. When the installation is finished, click the icon for UFED Physical Analyzer.
When the program has started, it will show a window that indicates...