iOS Mobile Forensics Methodologies, Extracting Biome Artifacts, and Overlooked Artifacts Needed to Improve Investigations

Digital forensic examiners are guided by best practices and methodologies to ensure their examinations and findings are sound and can hold up in a court of law. Apple iPhones are among the top two producing mobile devices on the market and account for a large portion of examinations by law enforcement and defense experts. Similarly, the data iOS devices have the ability to store and their evidentiary value are more important than ever as prosecution and defense rely on examiner findings that have far reaching consequences for those on trial. This paper will explore the options available for many iOS devices and the difference in data that can be obtained between Advance Logical and Full File System extractions. Additionally, it will describe some high-level artifacts and provide some best practices for the examiner to consider in order to get the most out of the examination and most importantly, obtain a full-picture and context of what courts rely on, facts and the truth.