Summary
iPhone backups contain essential information that may be your only source of evidence for the iPhone. Information stored in iPhone backups includes photos, videos, contacts, e-mail, call logs, user accounts and passwords, applications, device settings, and so on. This chapter covered techniques to create backup files and retrieve data from iTunes and iCloud backups including encrypted backup files, wherever possible. Chapter 5, iOS Data Analysis and Recovery, goes further into the forensic investigation by showing the examiner how to analyze the data recovered from the backup files. Areas containing data of potential evidentiary value will be explained in detail.