iPhone and iOS Forensics

iPhone and iOS Forensics is a guide to the forensic acquisition and analysis of iPhone and iOS devices, and offers practical advice on how to secure iOS devices, data and apps. The book takes an in-depth look at methods and processes that analyze the iPhone/iPod in an official legal manner, so that all of the methods and procedures outlined in the text can be taken into any courtroom. It includes information data sets that are new and evolving, with official hardware knowledge from Apple itself to help aid investigators.

This book consists of 7 chapters covering device features and functions; file system and data storage; iPhone and iPad data security; acquisitions; data and application analysis; and commercial tool testing.

This book will appeal to forensic investigators (corporate and law enforcement) and incident response professionals.

• Learn techniques to forensically acquire the iPhone, iPad and other iOS devices
• Entire chapter focused on Data and Application Security that can assist not only forensic investigators, but also application developers and IT security managers
• In-depth analysis of many of the common applications (both default and downloaded), including where specific data is found within the file system

1;Front Cover;1 2;iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad, and iOS Devices;4 3;Copyright;5 4;Contents;6 5;Acknowledgments;10 6;Preface;12 7;About the Authors;14 8;About the Technical Editor;16 9;Chapter 1: Overview;18 9.1;Introduction;18 9.1.1;Strategy;19 9.1.2;Development community;19 9.2;iPhone models;21 9.2.1;iPhone hardware;22 9.3;Forensic examination approaches;25 9.3.1;iPhone leveling;27 9.3.2;Acquisition types;29 9.3.3;Forensics with Linux;32 9.4;Summary;49 9.5;References;50 10;Chapter 2: Device Features and Functions;52 10.1;Introduction;52 10.2;Apple device overview;52 10.3;Operating modes;54 10.3.1;Normal mode;54 10.3.2;Recovery mode;54 10.3.3;DFU mode;54 10.3.4;Exiting Recovery/DFU mode;58 10.4;Security;59 10.4.1;Device settings;59 10.4.2;Secure erase;60 10.4.3;App security;61 10.5;iTunes interaction;61 10.5.1;Device synchronization;61 10.5.2;iPhone backups;62 10.5.3;iPhone restore;63 10.5.4;iPhone iOS updates;63 10.5.5;Upgrade;63 10.5.6;Downgrade;64 10.5.7;The App Store;69 10.5.8;MobileMe;69 10.6;Summary;69 10.7;References;70 11;Chapter 3: File system and data storage;72 11.1;Introduction;72 11.2;What data is stored;72 11.3;Where data is stored;73 11.4;How data is stored;76 11.4.1;Internal storage;76 11.4.2;SQLite database files;77 11.4.3;Property lists;79 11.4.4;Network;82 11.5;Memory types;82 11.5.1;RAM;82 11.5.2;NAND Flash;83 11.6;iPhone operating system;87 11.6.1;iOS layers;87 11.7;File system;88 11.7.1;Volumes;91 11.7.2;Journaling;91 11.7.3;iPhone disk partitions;92 11.8;Summary;93 11.9;References;94 12;Chapter 4: iPhone and iPad Data Security;96 12.1;Introduction;96 12.2;Data security and testing;97 12.2.1;Computer crime laws in the United States;97 12.2.2;Data protection in the hands of the administrators;99 12.2.3;Security testing procedure;102 12.3;Application security;110 12.3.1;Corporate or individual mobile app consumers;111 12.3.2;Corporate or individual mobile app developers;113 12.3.3;Ap
plication security strategies for developers;114 12.4;Recommendations for device and application security;118 12.5;Summary;120 12.6;References;121 13;Chapter 5: Acquisitions;124 13.1;Introduction;124 13.2;iPhone forensics overview;124 13.2.1;Types of investigations;125 13.2.2;Difference between logical and physical techniques;126 13.2.3;Modification of the target device;126 13.3;Handling evidence;128 13.3.1;Passcode procedures;128 13.3.2;Network isolation;128 13.3.3;Powered-off devices;129 13.4;Imaging an iPhone/iPad;129 13.4.1;Backup acquisition;129 13.4.2;Logical acquisition;136 13.4.3;Physical acquisition;137 13.5;Imaging other apple devices;150 13.5.1;iPad;150 13.5.2;iPod Touch;151 13.5.3;Apple TV;151 13.6;Summary;151 13.7;References;152 14;Chapter 6: Data and Application Analysis;154 14.1;Introduction;154 14.2;Analysis techniques;154 14.2.1;Mount disk image;154 14.2.2;File carving;155 14.2.3;Strings;161 14.2.4;Timeline development and analysis;163 14.2.5;Forensic analysis;170 14.3;iPhone data storage locations;176 14.3.1;Default applications;177 14.3.2;Downloaded apps;184 14.3.3;Other;187 14.4;iPhone application analysis and reference;195 14.4.1;Default applications;195 14.4.2;Third-party (downloaded) applications;218 14.5;Summary;227 14.6;References;227 15;Chapter 7: Commercial tool testing;230 15.1;Introduction;230 15.2;Data population;231 15.3;Analysis methodology;235 15.4;Cellebrite UFED;237 15.4.1;Installation;238 15.4.2;Forensic acquisition;239 15.4.3;Results and reporting;239 15.5;iXAM;245 15.5.1;Installation;246 15.5.2;Forensic acquisition;246 15.5.3;Results and reporting;247 15.6;Oxygen forensic suite 2010;251 15.6.1;Installation;253 15.6.2;Forensic acquisition;253 15.6.3;Results and reporting;254 15.7;XRY;256 15.7.1;Installation;259 15.7.2;Forensic acquisition;259 15.7.3;Results and reporting;259 15.8;Lantern;262 15.8.1;Installation;265 15.8.2;Forensic acquisition;265 15.8.3;Results and reporting;265 15.9;MacLock Pick;268 15.9.1;Installation;270 15.9.
2;Forensic acquisition;271 15.9.3;Results and reporting;271 15.10;Mobilyze;272 15.10.1;Installation;274 15.10.2;Forensic acquisition;274 15.10.3;Results and reporting;274 15.11;Zdziarski technique;277 15.11.1;Installation;280 15.11.2;Forensic acquisition;280 15.11.3;Results and reporting;280 15.12;Paraben device seizure;283 15.12.1;Installation;285 15.12.2;Forensic acquisition;285 15.12.3;Results and reporting;286 15.13;MobileSyncBrowser;289 15.13.1;Installation;290 15.13.2;Forensic acquisition;290 15.13.3;Results and reporting;291 15.14;CellDEK;292 15.14.1;Installation;293 15.14.2;Forensic acquisition;295 15.14.3;Results and reporting;295 15.15;Encase Neutrino;296 15.15.1;Installation;298 15.15.2;Forensic acquisition;299 15.15.3;Results and reporting;299 15.16;iPhone Analyzer;302 15.16.1;Installation;304 15.16.2;Forensic acquisition;304 15.16.3;Results and reporting;304 15.17;Summary;306 15.18;Reference;307 16;Appendix A;308 17;Appendix B;310 18;Appendix C;312 19;Index;320