IMessage SMS And Messaging Apps On IOS
i Message, SMS and Messaging Apps on iOS Where the Conversations Really Live, and Why Deletion, Edits and Encryption Change What You See COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many channels, one phone 03 Where iOS messaging data lives 04 What survives deletion 05 Edits, unsending and end-to-end encryption 06 Attribution, interpretation and honest limits 07 Deployment: recovering and proving conversations 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: an iPhone carries conversations across i Message, SMS and many third-party apps, each storing data differently, and three realities govern the evidence, deleted messages frequently survive, messages can be edited or unsent, and some apps are end-to-end encrypted, which limits interception but not recovery from the end point s.
§ 02 · FIRST PRINCIPLES The problem in plain English: many channels, one phone
§ 03 · WHEREITLIVES Where iOS messaging data lives
§ 04 · WHATSURVIVESDELETION What survives deletion
§ 05 · EDITS, UNSENDINGANDENCRYPTION Edits, unsending and end-to-end encryption
§ 06 · ATTRIBUTIONANDHONESTLIMITS Attribution, interpretation and honest limits
§ 07 · DEPLOYMENT Deployment: recovering and proving conversations
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE (INCL. MAC / THE I CLOUD / COUNTERPART DELETED / PHONE SYNC DEVICE RECOVERABLE BACKUPS PAIRED ENCRYPTED) IPAD
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETEDCONVERSATIONTHEDATABASEKEPT EXAMPLE2 · THEEDITEDMESSAGEANDTHEORIGINALBENEATHIT EXAMPLE3 · THEEND - TO - ENDAPPOPENEDATTHEENDPOINT
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANIOSMESS AG INGANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The iOS messaging checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Someone deleted a conversation. Can it be recovered? A message was edited. Can you see the original? The messages are in an end-to-end-encrypted app. Doesn't that stop recovery? Do we need to look at apps other than Messages? Does a message prove who sent it? What about disappearing messages?
§ 14 · REFERENCE Glossary SMS Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab 35 or CrimPR Part 19. This guide sits within the iPhone and iPad block. Conflicts checks, confidential scoping Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IMessage SMS And Messaging Apps On IOS, Computer Forensics Lab, https://e-discovery.uk/library/imessage-sms-and-messaging-apps-on-ios/pdf.