iOS Forensic Analysis: for iPhone, iPad and iPod Touch

✍ Scribed by Sean Morrissey

• Publisher: Apress
• Year: 2010
• Tongue: English
• Leaves: 374
• Edition: 1
• Category: Library

✦ Synopsis

 iOS Forensic Analysis provides an in-depth look at investigative processes for the iPhone, iPod Touch, and iPad devices. The methods and procedures outlined in the book can be taken into any courtroom. With iOS information never published before and data sets that are new and evolving,  this book gives the examiner and investigator the knowledge to complete a full device examination that will be credible and accepted in the forensic community.             What you’ll learn     How to respond to security incidents involving iOS devices      How to acquire and analyze data on iOS devices such as iPhone and iPad      How to analyze media exploitation on iOS devices    Who this book is for             Computer forensic professionals, law enforcement, attorneys, security professionals, those who are curious about such things, and educators.  This book can also be employed by law enforcement training academies, universities, as well as computer forensic, information security, and e-discovery communities.               Table of Contents     History of Apple Mobile Devices      iOS Operating and File System Analysis      Search, Seizure, and Incident Response      iPhone Logical Acquisition      Logical Data Analysis      Mac and Windows Artifacts      GPS Analysis      Media Exploitation      Media Exploitation Analysis      Network Analysis

✦ Table of Contents

Prelim......Page 1
Contents at a Glance......Page 6
Contents......Page 7
Foreword......Page 12
About the Author......Page 13
About the Technical Reviewer......Page 14
Acknowledgments......Page 15
Introduction......Page 16
History of Apple Mobile Devices......Page 17
The Evolution of Apple iPhones......Page 18
Web Apps......Page 20
Competitive Advantages......Page 21
Under the Surface: iPhone and iPad Hardware......Page 24
The Apple App Store......Page 35
Rise of the iPhone Hackers......Page 38
Summary......Page 39
Changing iOS Features......Page 41
Application Development......Page 47
The iOS File System......Page 49
iPhone Partition and Volume Information......Page 52
SQLite Databases......Page 65
Working with the Databases......Page 67
Summary......Page 82
Search, Seizure, and Incident Response......Page 83
The Fourth Amendment of the U.S. Constitution......Page 84
Cell Phone Searches Incident to Arrest......Page 85
Changing Technology and the Apple iPhone......Page 87
Responding to the Apple Device......Page 88
Isolating the Device......Page 91
Passcode Lock......Page 93
Identifying Jailbroken iPhones......Page 95
Information Collection of the iPhone......Page 96
Responding to Mac/Windows in Connection to iPhones......Page 100
References......Page 101
Acquiring Data from iPhone, iPod touch, and iPad......Page 103
Available Tools and Software......Page 108
Phone Information......Page 112
Call Logs......Page 113
Contacts......Page 114
Messages......Page 115
Notes......Page 116
Calendar......Page 117
Internet History......Page 118
Photos......Page 119
Dynamic Text Data......Page 121
Maps......Page 122
Setting Up and Navigating the Interface......Page 123
Acquiring Data......Page 126
Reporting Data......Page 127
The Good......Page 131
The Bad......Page 133
Oxygen Connection Wizard......Page 134
Oxygen Data Extraction Wizard......Page 136
Viewing Backup Data......Page 137
Setting Up Cellebrite......Page 142
Comparing the Tools and Results......Page 146
Summary......Page 149
Setting Up a Forensic Workstation......Page 151
Library Domain......Page 156
System Configuration Data......Page 184
Media Domain......Page 186
Third-Party Applications......Page 194
Antiforensic Applications and Processes......Page 213
Summary......Page 223
Artifacts from a Mac......Page 225
Artifacts from Windows......Page 228
Analysis of the iDevice Backups......Page 230
Windows Forensic Tools and Backup Files......Page 236
Summary......Page 241
Maps Application......Page 243
Geotagging of Images and Video......Page 253
Cell Tower Data......Page 264
Navigation Applications......Page 276
Summary......Page 281
What Is Digital Rights Management (DRM)?......Page 283
United States Constitution......Page 284
Fair Use Doctrine......Page 285
Case Study: DMCA......Page 286
Media Exploitation......Page 292
iXAM......Page 293
Image Validation......Page 300
Summary......Page 303
References......Page 304
Reviewing Exploited Media Using a Mac......Page 307
Mail......Page 311
Carving......Page 315
SQLite Databases......Page 329
Spyware......Page 333
Summary......Page 338
Custody Considerations......Page 339
Networking 101: The Basics......Page 340
Networking 201: Advanced Topics......Page 347
com.apple.network.identification.plist......Page 350
consolidated.db (iOS 4+)......Page 351
Summary......Page 358
¦ A......Page 359
¦ B......Page 360
¦......Page 361
¦ F......Page 363
¦ H......Page 364
¦......Page 365
¦ L......Page 366
¦......Page 367
¦......Page 368
¦ R......Page 369
¦ S......Page 370
¦ W......Page 371
¦......Page 372