Chapter 11: Locked Devices, iTunes Backups, and iCloud Forensics

Up to this point in the book, we have learned how to perform an iOS acquisition using different methods and how to analyze the extracted data to gain meaningful insights, such as interpreting location artifacts, parsing through media files, or analyzing pattern-of-life data. Everything we have covered so far relies on the fact that the iOS device that is being examined is unlocked, or the passcode is known; however, this is not always the case. There are some occasions in which the investigator may have to deal with locked devices, and that will be the focus of this chapter.

We will start the chapter by learning how to deal with locked devices, what options the examiner has, and how to attempt passcode cracking. Then, we will discuss Before First Unlock (BFU) acquisitions and learn what kind of data we can expect to find in such extractions. Later on in the chapter, we will introduce iTunes backups and we will learn...