Abstract
The iPod Touch, iPhone and iPad from Apple are among the most popular mobile computing platforms in use today. These devices are of forensic interest because of their high adoption rate and potential for containing digital evidence. The uniformity in their design and underlying operating system (iOS) also allows forensic tools and methods to be shared across product types. This paper analyzes the tools and methods available for conducting forensic examinations of the Apple iPad. These include commercial software products, updated methodologies based on existing jailbreaking processes and the analysis of the device backup contents provided by iTunes. While many of the available commercial tools offer promise, the results of our analysis indicate that most comprehensive examination of the iPad requires jailbreaking to perform forensic duplication and manual analysis of its media content.
Chapter PDF
Similar content being viewed by others
References
Apple, iPad: About backups, Cupertino, California (support.apple.com/kb/HT4079), 2009.
Apple, Apple sells three million iPads in 80 days, Cupertino, California (www.apple.com/pr/library/2010/06/22ipad.html), June 22, 2010.
Apple, iPad in Business: Security Overview, White Paper, Cupertino, California, 2010.
Apple, iPad Technical Specifications, Cupertino, California (www.apple.com/ipad/specs), 2011.
BlackBag Technologies, Mobilyze, San Jose, California (www.blackbagtech.com/forensics/mobilyze/mobilyze.html).
Comex, JailbreakMe 2.0 (www.jailbreakme.com).
Dev-Team Blog, Homepage (blog.iphone-dev.org).
Ecamm Network, PhoneView, Somerville, Massachusetts (www.ecamm.com/mac/phoneview).
Fat Cat Software, PlistEdit Pro, San Jose, California (www.fatcatsoftware.com/plisteditpro).
J. Freeman, Cydia (cydia.saurik.com).
A. Hoog and K. Gaffaney, iPhone Forensics White Paper, 2009.
iPhone Insecurity, Homepage (www.iphoneinsecurity.com).
S. Jobs, Keynote address, Apple Worldwide Developers Conference (www.apple.com/apple-events/wwdc-2010), 2010.
Katana Forensics, Easton, Maryland (www.katanaforensics.com).
P. Kennedy, iPhone/iPod Touch Backup Extractor (www.supercra zyawesome.com).
M. Kiley, T. Shinbara and M. Rogers, iPod forensics update, International Journal of Digital Evidence, vol. 6(1), 2007.
Macroplant, Phone Disk, Arlington, Virginia (www.macroplant.com/phonedisk).
Menial, Base (menial.co.uk/software/base).
R. Mislan, Cellphone crime solvers, IEEE Spectrum, vol. 47(7), pp. 34–39, 2010.
National Institute of Standards and Technology, Mobile devices, Computer Forensics Tool Testing Program, Gaithersburg, Maryland (www.cftt.nist.gov/mobile_devices.htm).
Oxygen Software, Oxygen Forensics Suite 2010, Moscow, Russia (www.oxygen-forensic.com/en).
J. Slay and A. Przibilla, iPod forensics: Forensically sound examination of an Apple iPod, Proceedings of the Fortieth Annual Hawaii International Conference on System Sciences, 2007.
Spirit, Homepage (www.spiritjb.com).
Weird Kid Software, Emailchemy, Detroit, Michigan (www.weird kid.com/products/emailchemy).
J. Zdziarski, iPhone Forensics, O’Reilly, Sebastopol, California, 2008.
J. Zdziarski, Jonathan Zdziarski’s Domain (www.zdziarski.com/blog/?p=524).
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2011 IFIP International Federation for Information Processing
About this paper
Cite this paper
Hay, A., Krill, D., Kuhar, B., Peterson, G. (2011). Evaluating Digital Forensic Options for the Apple iPad. In: Peterson, G., Shenoi, S. (eds) Advances in Digital Forensics VII. DigitalForensics 2011. IFIP Advances in Information and Communication Technology, vol 361. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-24212-0_20
Download citation
DOI: https://doi.org/10.1007/978-3-642-24212-0_20
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-24211-3
Online ISBN: 978-3-642-24212-0
eBook Packages: Computer ScienceComputer Science (R0)