Page 1
iPhone Forensics: The Defensible Mobile Evidence Bundle Bringing the Whole iPhone Block Together: From Seizure to a Bundle That Survives Challenge COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM CONVERGENCE & WEAKEST-LINK TESTING CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: many sources, one bundle 03 The sources the iPhone block established 04 Building the bundle: seizure to report 05 Convergence and the weakest link 06 Testing the bundle against challenge 07 Deployment: presenting a bundle that survives 08 Source architecture: the whole iPhone estate 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: the iPhone's many sources, device, backups, account, Watch and estate, become useful only when assembled into one coherent, defensible bundle, defensible not because any single source is strong unbroken, and every conclusion is stated at honest confidence.
§ 02 · FIRST PRINCIPLES The problem in plain English: many sources, one bundle
§ 03 · THE SOURCES The sources the iPhone block established DEVICE BACKUPS ICLOUD ACCOUNT WATCH / ESTATE ONE BUNDLE
Page 2
§ 04 · BUILDINGTHEBUNDLE Building the bundle: seizure to report
§ 05 · CONVERGENCEANDTHEWEAKESTLINK Convergence and the weakest link
§ 06 · TEST IN G THE BUNDLE Testing the bundle against challenge
§ 07 · DEPLOYMENT Deployment: presenting a bundle that survives
§ 08 · THEWHOLEESTATE Source architecture: the whole iPhone estate EVIDENCE DEVICE BACKUPS INDEPENDENT ICLOUD WATCH / COUNTERPART / ACCOUNT PAIRED PROVIDER
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEBUNDLETHATCONVERGEDWHEREONESOURCEWOULDHAVEFAILED EXAMPLE2 · THEWEAKESTLINKFOUNDBEFORETHEOTHERSIDEFOUNDIT EXAMPLE3 · THELOSTPHONEANDTHEBUNDLEBUILTFROMTHEESTATE
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR A DEFENSIBLE MOBILE EVIDENCE BUNDLE
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The defensible-bundle checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What makes a mobile evidence bundle "defensible"? Why not just rely on the strongest piece of evidence? What do you mean by "the weakest link"? How is the bundle tested before it is served? What if the phone itself is lost or wiped? Why does seizure matter so much to the final bundle?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IPhone Forensics The Defensible Mobile Evidence Bundle, Computer Forensics Lab, https://e-discovery.uk/library/iphone-forensics-the-defensible-mobile-evidence-bundle/pdf.