iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets - Jonathan Zdziarski

This manual, titled "iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets" by Jonathan Zdziarski and published by O'Reilly Media, is an essential resource for anyone involved in examining iPhones. It provides comprehensive and specialized forensic analysis for the iPhone, iPhone 3G, and iPod Touch. Whether you are a professional IT or security expert or a DIY enthusiast, this manual equips you with the knowledge and techniques necessary to recover, analyze, and securely destroy sensitive data stored on these devices.

With the increasing use of iPhones in business networks, the need for understanding how to handle the vast amount of information stored on these devices is crucial. This manual offers valuable insights and techniques used by over 200 law enforcement agencies worldwide, making it an indispensable resource for corporate compliance and disaster recovery plans.

The manual covers a wide range of topics, including:

• Determining the type of data stored on the device
• Bypassing v1.x and v2.x passcode-protected iPhones to gain access
• Building a custom recovery toolkit for the iPhone
• Interrupting iPhone 3G's "secure wipe" process
• Conducting data recovery and preserving the entire raw user disk partition
• Recovering deleted voicemail, images, email, and other personal data using data carving techniques
• Recovering geotagged metadata from camera photos
• Discovering Google map lookups, typing cache, and other data stored on the live file system
• Extracting contact information from the iPhone's database
• Utilizing different recovery strategies based on case needs

Whether you are a professional in need of specialized forensic analysis or a DIY enthusiast looking to understand the intricacies of iPhone data recovery, "iPhone Forensics" is an invaluable resource that provides clarity and expertise in the field of digital forensics.

Published in 2008, this 144-page manual is available in unencrypted PDF format.