iOS backup parsing with AXIOM

The AXIOM program has already been described in Chapter 8, Analyzing Physical Dumps and Backups of Android Devices. In this recipe, we will describe how to analyze an iTunes backup via AXIOM.

How to do it…

1. Double-click the AXIOM Process icon. In the program’s window, click the CREATE NEW CASE button. In the next window, fill in the case information fields, such as Case number, Folder name, File path, and Scanned by, then click the GO TO EVIDENCE SOURCES button. In the next window, in the SELECT EVIDENCE SOURCE section, click the MOBILE icon. In the next window, click the IOS icon:

SELECT EVIDENCE SOURCE (MOBILE) section

2. In the next window, click the LOAD EVIDENCE icon. In the next window, click on the FILES & FOLDERS icon. In the opened additional EVIDENCE SOURCES window, click the WINDOWS FOLDER BROWSER button. Specify the path to the iTunes backup to be examined and click the Select Folder button.
3. Click the GO TO PROCESSING DETAILS button. In the next window...