Page 1

IOSACQUISITIONMETHODS · A GUIDE FOR UK LAWYERS iOS Full-File-System vs Logical Acquisition How Deep the Extraction Goes, and Why It Matters for What You Will Find COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM EXTRACTION-DEPTH ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: depth changes the answer 03 Logical acquisition: what the phone hands over 04 Full-file-system acquisition: the deeper record 05 What each reaches, and what it misses 06 Availability, method choice and honest limits 07 Deployment: matching the method to the matter 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: iOS extractions differ in depth, a logical acquisition collects what the phone hands over through normal interfaces, while a full-file-system acquisition reaches the deeper file system including far always be under stood and stated.

§ 02 · FIRST PRINCIPLES The problem in plain English: depth changes the answer

§ 03 · LOGICALACQUISITION Logical acquisition: what the phone hands over