Ios Mobile Device Forensics: Initial Analysis

The ability to recover forensic artifacts from mobile devices is proving to be an ever-increasing challenge for investigators. Coupling this with the ubiquity of mobile devices and the increasing complexity and processing power they contain results in a reliance on them by suspects. In investigating Apple’s iOS devices -- namely the iPhone and iPad -- an investigator’s challenges are increased due to the closed nature of the platforms. What is left is an extremely powerful and complex mobile tool that is inexpensive, small, and can be used in suspect activities. Little is known about the internal data structures of the device or the proper method of extracting forensically sound images of them. This article will discuss the current state of iOS mobile device forensics. An examination of what data is contained on the devices as well as what can currently be extracted from suspect device is looked at. Jailbreaking an iOS device will be evaluated against its pros and cons along with current professional and open source tools. Finally, a discourse on our continuing research into deleted file recovery and future works is presented. Keywords: Digital Forensics, iOS, iPhone, iPad, Mobile Devices, Security, Analysis, Tool