Understanding forensic tools

Once the iOS device and the evidence stored within it have been successfully seized, preserved, and extracted through a forensically sound acquisition process, the next steps involve processing and analyzing the extracted data.

Currently, there are a number of commercial tools available on the market that perform data analysis, such as Cellebrite Physical Analyzer, Oxygen Forensic Detective, Magnet AXIOM, Belkasoft Evidence Center, MSAB XRY, EnCase Forensic, and many others. In this chapter, we'll work with two of these tools, Cellebrite Physical Analyzer and Magnet AXIOM.

We've already seen how mobile forensics presents several additional challenges compared to digital forensics, and one significant difference has to do with how data extracted from iOS devices is analyzed; with mobile device forensics, using a single tool to process and analyze the evidence is extremely risky, as one solution will not provide all the tools that support...