Chapter 4: Working with Common iOS Artifacts

In previous chapters, we discussed in broad terms how the iOS operating system works and the different phases of the mobile examination workflow. Then, we learned all about different acquisition methods and how to extract the richest amount of data from a device. In the third chapter, we looked at forensic tools and continued our examination process by loading the data into the tool for analysis.

One of the most critical aspects of a mobile forensics investigation is validating your findings. We've already discussed the importance of tool validation in earlier chapters, but the process should be extended to ensure the integrity of the data collected and to understand and explain the context of the data, as this is essential for presenting it as evidence in court. This usually entails following the source file and manually viewing the artifacts in their native format.

In this chapter, we first look at the most common types of artifacts...