Physical acquisition

iOS devices have two types of memory: volatile (RAM) and non-volatile (NAND Flash). RAM is used to load and execute the key parts of the operating system or the application. The data stored on the RAM is lost after a device reboots. RAM usually contains very important application information such as active applications, usernames, passwords, and encryption keys. Though the information stored in the RAM can be crucial in an investigation, currently there is no method or tool available to acquire the RAM memory from a live iPhone.

Unlike RAM, NAND is non-volatile memory and retains the data stored in it even after a device reboots. NAND flash is the main storage area and contains the system files and user data (http://www.nist.gov/forensics/research/upload/draft-guidelines-on-mobile-device-forensics.pdf). The goal of physical acquisition is to perform a bit-by-bit copy of the NAND memory, similar to the way in which a computer hard drive would be forensically acquired...