Introduction

The main sources of data extracted from Apple mobile devices are:

• Physical dumps
• Filesystems
• Backups

Physical dumps and filesystems are the minimum part of all objects that come for analysis to forensic laboratories. This is due to the security mechanisms used in Apple mobile devices. The vast majority of objects are backups. iTunes is an Apple company tool that is used for backup creation on Apple mobile devices. Forensic tools, overtly or covertly from the expert, also basically extract data from Apple's mobile devices indirectly: first, they create an iTunes backup, and then they extract data from it.

Backups can be found on the following paths:

• mac OS X: C:\Users\<User Name>\Library\Application Support \ MobileSync\Backup\
• Windows XP: C:\Documents and Setting\<User Name>\ Application Data\Apple Computer\MobileSync\Backup\
• Windows Vista, 7, 8, and 10: C:\Users\<User Name>\AppData\ Roaming\Apple Computer\MobileSync\Backup\

iTunes backups can have different formats...