Chapter 3. iOS Forensic Tools
The examiner must not only know how to use forensic tools, but must understand the methods and acquisition techniques deployed by the tools they use in their investigations. Forensic tools not only save time but also make the process a lot easier. However, each tool has its flaws, and the examiner must catch mistakes and know how to correct them by leveraging another tool or technique. It's impossible for a tool to support all devices, and the examiner is responsible for learning and using the best tools to complete the job. As discussed in the last chapter, the examiner must understand how data is stored on iOS devices to ensure that the tool is capturing all accessible data. Without an expectation of what your forensic tool should extract, the examiner is limited and will be forced to rely solely on a tool.
Currently, there are several commercial tools such as Elcomsoft iOS Forensic Toolkit, Cellebrite (UFED4PC, Touch, and Physical Analyzer...