iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets
"This book is a must for anyone attempting to examine the iPhone. The level of forensic detail is excellent. If only all guides to forensics were written with this clarity!" -Andrew Sheldon, Director of Evidence Talks, computer forensics experts\ With iPhone use increasing in business networks, IT and security professionals face a serious challenge: these devices store an enormous amount of information. If your staff conducts business with an iPhone, you need to know how to recover, analyze,...
Search in google:
"This book is a must for anyone attempting to examine the iPhone. The level of forensic detail is excellent. If only all guides to forensics were written with this clarity!" -Andrew Sheldon, Director of Evidence Talks, computer forensics expertsWith iPhone use increasing in business networks, IT and security professionals face a serious challenge: these devices store an enormous amount of information. If your staff conducts business with an iPhone, you need to know how to recover, analyze, and securely destroy sensitive data. iPhone Forensics supplies the knowledge necessary to conduct complete and highly specialized forensic analysis of the iPhone, iPhone 3G, and iPod Touch. This book helps you:Determine what type of data is stored on the device Break v1.x and v2.x passcode-protected iPhones to gain access to the device Build a custom recovery toolkit for the iPhone Interrupt iPhone 3G's "secure wipe" process Conduct data recovery of a v1.x and v2.x iPhone user disk partition, and preserve and recover the entire raw user disk partition Recover deleted voicemail, images, email, and other personal data, using data carving techniques Recover geotagged metadata from camera photos Discover Google map lookups, typing cache, and other data stored on the live file system Extract contact information from the iPhone's database Use different recovery strategies based on case needs And more. iPhone Forensics includes techniques used by more than 200 law enforcement agencies worldwide, and is a must-have for any corporate compliance and disaster recovery plan.
Foreword ix Preface xi1 Introduction to Computer Forensics 1 Making Your Search Legal 1 Rules of Evidence 2 Good Forensic Practices 3 Technical Processes 52 Understanding the iPhone 7 What's Stored 8 Equipment You'll Need 10 Determining the Firmware Version 10 Disk Layout 11 Communication 12 Upgrading the iPhone Firmware 13 Restore Mode and Integrity of Evidence 14 Cross-Contamination and Syncing 153 Accessing the iPhone 19 Installing the Recovery Toolkit (Firmware v1.0.2-1.1.4) 19 Circumventing Passcode Protection (Firmware v1.0.2-1.1.4) 26 Installing the Recovery Toolkit (Firmware v2.x) 30 Removing the Forensic Recovery/Toolkit 424 Forensic Recovery 43 Configuring Wi-Fi and SSH 43 Recovering the Media Partition 47 Data Carving Using Foremost/Scalpel 55 Validating Images with ImageMagick 61 Strings Dump 62 The Takeaway 635 Electronic Discovery 65 Converting Timestamps 65 Mounting the Disk Image 66 Graphical File Navigation 67 Extracting Image Geotags with Exifprobe 69 SQLite Databases 70 Important Database Files 72 Property Lists 81 Other Important Files 856 Desktop Trace 87 Proving Trusted Pairing Relationships 88 Serial Number Records 91 Device Backups 92 Activation Records 937 Case Help 97 Employee Suspected of Inappropriate Communication 97 Employee Destroyed Important Data 100 Seized iPhone: Whose Is It and Where Is He? 101 Appendix Disclosures and Source Code 105 Index 115
