When possible, it would be recommended to obtain a full physical memory extraction since that will likely contain data that the file system dump & AFC backup does not (deleted file system data, etc.). file dump vs AFC file backupĭepending on the type of investigation, the tools you have available and the version of the iOS phone you need to examine, you may have a choice whether to conduct a physical memory extraction, a file system dump or an Apple File Connection (AFC) backup.
Depending on the iOS version, device hardware version and passcode complexity, the passcode can sometimes be obtained by the forensic tool (such as Cellebrite) using a bruteforce attack. In many cases, you will need the passcode in order to obtain a physical image or a file system dump. A complex alphanumeric passcode or passphrase.Handset Passcodesĭepending on the version of iOS, different passcode lengths and complexities are supported. This article will discuss some of the steps involved and areas of interest when conducting an analysis of an iOS device for Internet related activity. Regardless of the statistics, if you are an active forensic examiner, chances are very high you will need to conduct an examination of an iOS mobile device (if you haven’t several times already). While iOS seems to be the leading operating system for tablets worldwide, Android continues to be the leading operating system for mobile phones worldwide. As of January 2013, Apple announced it had sold over 500 million iOS devices.
0 kommentar(er)
