iOS physical dump and backup parsing with Oxygen Forensic
The Oxygen Forensic program has already been described in Chapter 1, SIM Cards Acquisition and Analysis. In this recipe, we will show how to analyze an iTunes backup via Oxygen Forensic.
How to do it…
- In order to import data from an iTunes backup, click the arrow to the right of the
Import filebutton on the Oxygen Forensic toolbar. In the drop-down menu, go toImport Apple backup/imageand thenImport iTunes backup ....
Selection of the data import type
- In the opened window, specify the path to the backup copy. Select the
Manifest.plistfile and click theOpenfile.
- In the new window, fill in the details of the case, such as
Case number,Evidence number,Place,Incident number,Backup password(optional),Inspector,Device owner,Owner email, and so on. If you need to recover deleted data, tickSearch and recover deleted data from applications. The process of data restoration will take additional time. Click theNextbutton:
Window of...
