IOS Backups ITunes Finder And ICloud
IOSBACKUPS · A GUIDE FOR UK LAWYERS iOS Backups: iTunes/Finder and iCloud The Copy of the Phone That Survives When the Phone Does Not, and Why Encryption Helps You COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the phone's shadow copy 03 Where iOS backups live 04 What each backup contains 05 Why an encrypted backup holds more 06 Locating, access in g and dating backups 07 Deployment: the locked phone and the deleted data 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary the device cannot, and, strikingly, an encrypted local backup holds more than an unencrypted one.
§ 02 · FIRST PRINCIPLES The problem in plain English: the phone's shadow copy
§ 03 · WHEREBACKUPSLIVE Where iOS backups live ITUNES BACKUP FINDER BACKUP ICLOUD BACKUP HISTORIC COPIES ENCRYPTED?
§ 04 · WHATEACHCONTAINS What each backup contains
§ 05 · WHYENCRYPTIONHOLDSMORE Why an encrypted backup holds more
§ 06 · LOCATINGANDDATING Locating, access in g and dating backups
§ 07 · DEPLOYMENT Deployment: the locked phone and the deleted data
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE BACKUP / THE ENCRYPTED UNENCRYPTED PAIRED APP DEVICE LOCAL BACKUP LOCAL BACKUP MAC / IPAD PROVIDER ICLOUD SYNC
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THELOCKEDPHONEANDTHECOMPUTERBACKUPTHATANSWERED EXAMPLE2 · THEENCRYPTEDBACKUPTHATHELDMORE EXAMPLE3 · THEDELETEDMESSAGESAPRIORBACKUPPRESERVED
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANIOSB AC KUPANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The iOS backup checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions The phone is locked. Can a backup still help? Why would an encrypted backup contain more? Is a backup a complete copy of the phone? Can a backup recover deleted messages? Where do we find the backups? Do we need the backup password?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IOS Backups ITunes Finder And ICloud, Computer Forensics Lab, https://e-discovery.uk/library/ios-backups-itunes-finder-and-icloud/pdf.