The iPhone is among the most popular smartphones on the market. Apple released the first-generation iPhone in June 2007. Ever since the first release, the iPhone has gained a lot of popularity due to its advanced functionality and usability. The introduction of the iPhone has redefined the entire world of mobile computing. Consumers started looking for faster and more efficient phones. Various iPhone models exist now, with different features and storage capabilities to serve consumer requirements.

The iPhones released since the second edition of Practical Mobile Forensics, the iPhone SE, 7, 7 Plus, 8, 8 Plus, and X, remain difficult when dealing with physical forensic acquisition methods. Just like the devices released since the iPhone 5, there is no method or tool available to physically recover data from these devices, unless they are jailbroken. However, the filesystem...

The iPhone is a collection of modules, chips, and electronic components from different manufacturers. Due to the complexities of the iPhone, the list of hardware components is extensive and each device should be researched for internal components.

The following images show the internals of the iPhone 8. The images were taken after dismantling the iPhone 8. Internal images for all iPhones can be found in the teardown section at https://www.ifixit.com/Device/iPhone.

This is the front of the dismantled iPhone 8:

This is the back of the dismantled iPhone 8:

The Apple iPhone changed the way cell phones are produced and used. Similarly, the iPad, a version of the tablet computer introduced in January 2010, squashed the sales of notebooks. With the iPad, individuals can shoot videos, take photos, play music, read books, browse the internet, and do much more. Various iPad models exist now, with different features and storage capabilities. Details on identifying iPad models can be found at https://support.apple.com/en-in/HT201471.

The most recent iPad models are listed in the following table:

As with the iPhone, not all versions of the iPad are supported for physical acquisition. In addition, Apple has changed data storage locations in iOS versions, which affects the iPad devices as well. The examiner must be aware of the different models, the released and currently installed iOS version, storage capability, network access...

One of the key factors of the success of Apple iOS devices is the proper selection of its hardware components. Just like the iPhone, the iPad is also a collection of modules, chips, and electronic components from different manufacturers. Internal images for all iPads can be found in the teardown section of https://www.ifixit.com/Device/iPad.

The following images show the internals of the iPad Pro. The images were taken after dismantling the iPad Pro cellular model and were obtained from https://www.ifixit.com/Teardown/iPad+Pro+10.5-Inch+Teardown/92534:

The following image shows the other side of the iPad Pro:

The Apple Watch was released in spring 2015. This smartwatch enables users to sync iPhone data to the watch and leverage the watch as a way to interact with the iPhone and as a singular device. The Apple Watch enables users to answer calls, send and respond to SMS, iMessage and email, access third-party applications, use Apple maps, and more. The Apple Watch can only be paired with an iPhone capable of running iOS 8.2 or later, not an iPad. The first release of Watch OS required the watch to be within Bluetooth range of the iPhone for full functionality, but Watch OS 2.X allows the watch to function independently on Wi-Fi. The Apple Watch 3 was first introduced on September 12, 2017 and released on September 22 with iPhone 8. It requires iOS 11 or later running on an iPhone 5S or newer. The third series has built-in LTE cellular...

While there are two sizes of the Apple Watch, the hardware is similar for each. Apple has not disclosed the complete Watch specifications, which forces us to rely on the little we currently know.

The following image shows the internals of the Apple Watch. The images were taken after dismantling the Apple Watch, and were obtained from https://www.ifixit.com/Teardown/Apple+Watch+Series+3+Teardown/97521:

The following image shows the reverse side of the Apple Watch Series 3:

To better understand the forensic process of an iOS device, it is good to know about the filesystem that is used. The filesystem used in the iPhone and other Apple iOS devices is HFSX, a variation of HFS Plus with one major difference. HFSX is case-sensitive whereas HFS Plus is case-insensitive. Other differences will be discussed later in this chapter. OS X uses HFS Plus by default and iOS uses HFSX. Apple File System (APFS) was introduced in June 2016 as a replacement for HFS+, and released for iOS devices with the release of iOS 10.3, and for macOS devices with the release of macOS 10.13.