Page 1
IOSACQUISITIONMETHODS · A GUIDE FOR UK LAWYERS iOS Full-File-System vs Logical Acquisition How Deep the Extraction Goes, and Why It Matters for What You Will Find COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM EXTRACTION-DEPTH ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: depth changes the answer 03 Logical acquisition: what the phone hands over 04 Full-file-system acquisition: the deeper record 05 What each reaches, and what it misses 06 Availability, method choice and honest limits 07 Deployment: matching the method to the matter 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: iOS extractions differ in depth, a logical acquisition collects what the phone hands over through normal interfaces, while a full-file-system acquisition reaches the deeper file system including far always be under stood and stated.
§ 02 · FIRST PRINCIPLES The problem in plain English: depth changes the answer
§ 03 · LOGICALACQUISITION Logical acquisition: what the phone hands over
Page 2
§ 04 · FULL - FILE - SYSTEM ACQUISITION Full-file-system acquisition: the deeper record
§ 05 · WHATEACHREACHES What each reaches, and what it misses
§ 06 · AVAILABILITYANDHONESTLIMITS Availability, method choice and honest limits
§ 07 · DEPLOYMENT Deployment: matching the method to the matter
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE SYSTEM I CLOUD LOGICAL COMPUTER PAIRED APP PROVIDER / (DEVICE) BACKUP MAC / IPAD CARRIER FULL-FILE- (DEVICE)
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDELETEDMESSAGESALOGICALEXTRACTIONMISSED EXAMPLE2 · THELOGICALEXTRACTIONTHATWASENOUGH EXAMPLE3 · THEDEPTHTHATWASNOTAVAILABLE, ANDTHEESTATETHATHELPED
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANIOSE XT R AC TION
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The extraction-depth checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What is the difference between logical and full-file-system extraction? If a logical extraction found nothing, does that mean it isn't there? Do we always need the deeper extraction? Can you always do a full-file-system extraction? Why does the method used need to be disclosed? Can backups make up for a shallow device extraction?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IOS Full File System Vs Logical Acquisition, Computer Forensics Lab, https://e-discovery.uk/library/ios-full-file-system-vs-logical-acquisition/pdf.