Chapter 5. iOS Data Analysis and Recovery
A key aspect in iPhone forensics is to examine and analyze the data acquired from an iPhone to interpret the evidence. Data on most iOS devices is encrypted and requires that the data partition be decrypted prior to an examination. In the previous chapters, you learned various techniques to acquire data from an iPhone. The raw disk image obtained during physical acquisition, the file system dump or the logical/backup file contains hundreds of data files. This chapter will help you to understand how data is stored on the iPhone and will walk you through the important files in order to recover the most data possible.