You're reading from iOS Forensics for Investigators Take mobile forensics to the next level by analyzing, extracting, and reporting sensitive evidence

Product type Paperback

Published in May 2022

Publisher Packt

ISBN-13 9781803234083

Length 316 pages

Edition 1st Edition

Tools

iOS

Concepts

Forensics

Author (1):

Gianluca Tiepolo

View More author details

Table of Contents (17) Chapters

Preface

1. Section 1 – Data Acquisition from iOS Devices

2. Chapter 1: Introducing iOS Forensics FREE CHAPTER

3. Chapter 2: Data Acquisition from iOS Devices

4. Section 2 – iOS Data Analysis

5. Chapter 3: Using Forensic Tools

6. Chapter 4: Working with Common iOS Artifacts

7. Chapter 5: Pattern-of-Life Forensics

8. Chapter 6: Dissecting Location Data

9. Chapter 7: Analyzing Connectivity Data

10. Chapter 8: Email and Messaging Forensics

11. Chapter 9: Photo, Video, and Audio Forensics

12. Chapter 10: Analyzing Third-Party Apps

13. Chapter 11: Locked Devices, iTunes Backups, and iCloud Forensics

14. Section 3 – Reporting

15. Chapter 12: Writing a Forensic Report and Building a Timeline

16. Other Books You May Enjoy

Working with Magnet AXIOM

Magnet AXIOM is one of the most popular tools for digital forensics. It supports both computer forensics and mobile forensics, with complete support for almost all Android and iOS devices. The software has two modules, AXIOM Process and AXIOM Examine. The first module is responsible for acquiring evidence from a device or loading an existing extraction, and performs data parsing and decoding. When the decoding process is done, you can use AXIOM Examine to review all recovered artifacts and analyze the data.

Loading evidence and on-the-fly processing

One of the key features of Magnet AXIOM is that it allows investigators to start analyzing artifacts while the data is being processed. This is a life-saving feature in all those circumstances where time is a critical factor and evidence needs to be reviewed as soon as possible.

In the following example, we'll learn how to load an existing filesystem extraction from an iOS device into AXIOM Process...