iCloud backups the photos, application data, device settings, messages and mail, etc. ICloud allows backup & restoring the iPhone contents over Wi-Fi/3 G to a cloud with a registered Apple account. This article briefs about iCloud backups and provides a deep analysis of iTunes backups. With iOS 5, data stored on the iPhone can be backed up to a computer with iTunes or to a cloud based storage with iCloud. Below are the details outlining their research and an overview on usage of backup recovery tools. Researchers at Sogeti Labs have released open source forensic tools (with the support of iOS 5) to read normal and encrypted iTunes backups. Goal: Extracting data and artifacts from the backup without altering any information. Backups shown in the article are captured using iTunes 10.6. Note: iPhone 4 GSM model with iOS 5.0.1 is used for the demos. So, gaining access to the computer’s file system will also give access to the mobile devices’ data. When a computer is used to sync with the iPhone, most of the information on the iPhone is likely to be backed up onto the computer. Understanding the forensics techniques on iTunes backups is also useful in cases where we get physical access to the suspect’s computer instead of the iPhone directly. This article explains the technical procedure and challenges involved in extracting data and artifacts from the iPhone backups. iTunes uses AFC (Apple file connection) protocol to take the backup and also the backup process does not modify anything on the iPhone except the escrow key records. In critical cases, forensic examiners rely on analyzing the iPhone logical backups acquired through iTunes. Forensic analysis on a live device reboots the phone and may alter the information stored on the device.
This Previous article on iPhone forensics detailed the forensic techniques and the technical challenges involved in performing live device forensics. IPhone forensics can be performed on the backups made by iTunes or directly on the live device. Interested in formal iPhone forensics course? Check out our 3 day iPhone and iOS forensics training now available.
0 kommentar(er)
