iOS device backups contain essential information that may be your only source of evidence. Information stored in iOS backups includes photos, videos, contacts, email, call logs, user accounts and passwords, applications, device settings, and more. This chapter covered techniques to create backup files and retrieve data from iTunes and iCloud backups, including encrypted backup files, wherever possible.
Chapter 5, iOS Data Analysis and Recovery, goes further into the forensic investigation by showing the examiner how to analyze the data recovered from the backup files. Areas containing data of potential evidentiary value will be explained in detail. Chapter 5, iOS Data Analysis and Recovery, will then teach you how to analyze the data pulled from Chapter 3, Data Acquisition from iOS Devices, and artifacts pulled from backup files as discussed in this chapter.
...
