Chapter 10: Analyzing Third-Party Apps
The App Store, which was released in 2008, allows users to download third-party apps on their iOS devices. As of 2021, there were more than 4.5 million apps available for download. Once an app is available on the store, developers can publish updates containing bug fixes or new features that will automatically be installed on the device. This poses a problem from a forensic viewpoint, as many forensic tools aren't able to keep up with the speed at which apps are updated, while some applications are simply not supported altogether.
When a third-party application needs to be analyzed for an investigation, the examiner will most likely have to resort to manually researching, validating, and analyzing the artifacts, and this is exactly what we'll be discussing in this chapter.
We will start by learning how to understand which apps are installed on a device, where they are located, and where the investigator should be looking for any...