Introduction
Mobile devices from the Apple company, such as iPhones and iPads, occupy about 15% of the mobile device market. Due to this fact, they often become the object of forensic analysis.
Mobile devices from the Apple company are the most complex objects in forensic analysis. The restrictions of access to the user’s data used in the devices do not allow extracting the data in full. The encryption makes the use of all known file recovery algorithms useless. Even if you manage to recover a file in some way, its content will be unavailable, as it will remain encrypted.
The complete examination of an Apple device is possible if you jailbreak it. The file system can be extracted from such a device and via analysis of the file system, you can extract a maximum number of user data. However, this operation cannot be performed for all types of such devices.
For mobile devices up to and including the iPhone 4, you can make physical dumps. It allows you not only to fully extract user’s data from...
