±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 124

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iOS Preservation

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

iOS Preservation

Post Posted: Jun 01, 18 02:22

Howdy folks,

Is there any forensic/chain of custody issue in simply using iTunes Backup to preserve iOS devices? That is, is any significant metadata affected on the device as a result of such a preservation method?

As it seems, most tools such as Oxygen Forensic use the iTunes Backup method to extract the data anyhow.

Once extracted, tools can be run on the backup data.

Anything I am missing?

Many thanks! Idea Mr. Green  


Re: iOS Preservation

Post Posted: Jun 01, 18 08:33

I think all the forensic tools can guarantee the data flow is single direction (from mobile phone to computer). However, if you just use the normal itunes to backup the data from iPhone, you may have a chance due to miss config the itunes to add or remove data from the iPhone  

Senior Member

Re: iOS Preservation

Post Posted: Jun 01, 18 21:46

Best practice is to create an encrypted iTunes mobile backup rather than a non-encrypted mobile backup as the encryption process will extract more data from the iPhone during the mobile backup creation process.

You can simply use 1234 as the iTunes encryption password.  

Senior Member

Re: iOS Preservation

Post Posted: Jun 02, 18 00:08

Belkasoft Acquisition Tool and Magnet Acquire are free iOS acquisition tools that you may as well use instead of iTunes...  

Senior Member

Re: iOS Preservation

Post Posted: Jun 02, 18 06:18

The forensic programs usually are user interfaces for iTunes and helper processes running in the background.

Always encrypt the iTunes backup you create, it's not only a matter of security, but also an extended feature settings to gain more data.

If you got time, do a comparison with the same device with encrypted and non-encrypted iTunes backup, so you can see what you would be missing with non-encrypted method.

...and write a feedback here with your results Smile
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 

Page 1 of 1