Mac and Windows Artifacts
In this book, we’ve put a lot of emphasis on the iPhone and not a lot on the data that could be left behind on a Mac or Windows computer. Most investigators forget to grab any Mac or Windows computers or to specify within their search warrants that important data is on the desktops; these computers can have historical data and passcodebypass certificates. Not everyone syncs their iPod touch or iPhone as often as in the past, because more and more information is able to be added to these devices without ever syncing with a desktop computer. However, when a new update is released from Apple, Apple has made it necessary to connect to a computer and update the device. During the update process and without user intervention, iTunes automatically creates a backup of the device prior to installing the new firmware. So, both on a Mac and on a Windows computer, there will be historical data left behind.
KeywordsVirtual Machine Apple Computer Property List Disk Image Window Computer
Unable to display preview. Download preview PDF.