《《Forensic analysis of iPhone backups》.pdfVIP

Forensic analysis of iPhone backups The goal of iPhone Backup Forensics analysis is extracting data and artefacts from the iTunes backups without altering any information. iPhone forensics can be performed on the backups made by iTunes or directly on the live device. My last article on iPhone forensics detailed the forensic techniques and the technical challenges involved in performing live device forensics. Forensic analysis on live device reboots the phone, may alter the information stored on the device. In critical investigations, forensic examiners rely on analyzing the iPhone logical backups acquired through iTunes. iTunes uses AFC (Apple file connection) protocol to take the backup and the backup process does not modify anything on the iPhone except the escrow key records. This article explains the technical procedure and challenges involved in extracting data and artefacts from the iPhone backups. Understanding the forensic techniques on iTunes backups is also useful in cases where we get physical access to the suspect’s computer instead of the iPhone directly. When a computer is used to sync with the iPhone, most of the information on the iPhone is likely to be backed up onto the computer. So gaining access to the computer’s file system will also gives access to the mobile devices’ data. Techniques explained in this article works on all Apple Devices which are running with iOS 5. Note: iPhone 4 GSM model with iOS 5.0.1 is used for the demos. Backups shown in the article are captured on Mac OS X Lion 10.6 using iTunes 10.6 . Researchers at Sogeti Labs have released open source forensic tools (with the support of iOS 5) to read normal and encrypted iTunes backups. Below details outline their research and gives an overview on usage of backup recovery tools. iOS Backups: With iOS 5, data stored on the iPhone can be backed up to a computer with iTunes or to a cloud based storage with iCloud. The article briefs