An examiner must not only know how to use forensic tools, but must also understand the methods and acquisition techniques deployed by the tools they use in their investigations. Forensic tools not only save time, but also make the process a lot easier. However, each tool has its flaws, and the examiner must catch any mistakes and know how to correct them by leveraging another tool or technique. It's impossible for a tool to support all devices, and the examiner is responsible for learning and using the best tools to complete the job. As discussed in the previous chapters, the examiner must understand how data is stored on iOS devices, to ensure that the tool is capturing all accessible data. Without an expectation of what their forensic tool should extract, the examiner is limited and will be forced to rely solely on a tool.
Currently, there are a number...
