Logical Data Analysis

Abstract

Apple’s mobile devices can contain a huge amount of data. There is telephony-type data such as call logs, address books, and text messages. There is data from third-party applications that could be a subset of the 300,000+ apps that are on the App Store. In addition, with the iPad and iWorks, document editing and storage are now possible, and all this data can interact with other applications. Apple devices do more than ever before. People can create data with phones as well; for example, iMovie, iWorks, and many other applications allow users to communicate in different mediums. As with all things that are beneficial for society, these tools can also be used for criminal activity. Therefore, it is incumbent on investigators to look at all the data and know how it was placed onto the phone. This chapter will show how to set up a forensic workstation and comb through iPhone directories and artifacts.