iOS Mobile Forensics: Complete Detailed Guide

• Photograph the device in its found position before handling it.
• Note whether the screen is on or off, and record the visible battery level if available.
• Record physical condition, connected accessories, SIM presence, and whether it is charging.
• Document the environment, including Faraday bags, signal blockers, laptops, chargers, or nearby paired devices.
• Record the exact seizure time and date in UTC, plus local time zone context.

• If the screen is accessible, enable Airplane Mode, then manually disable Wi-Fi and Bluetooth because newer iOS versions may leave them active.
• If available, place the device in a tested Faraday bag that blocks cellular, Wi-Fi, Bluetooth, and GPS signals.
• Keep the device powered and charging when possible, especially if it may already be in After First Unlock state.
• Do not use signal jamming unless it is lawful in your jurisdiction and approved by your organisation.

• The UID key is unique to each device and is burned into silicon. It never leaves the hardware and is part of the user data encryption chain.
• The GID key is shared by devices with the same chip family and is used for firmware-related operations, not ordinary user data access.

• Every stage of the iOS boot process is cryptographically signed by Apple.
• Unsigned boot code and arbitrary downgrade workflows are blocked on modern devices.
• Without the passcode, Class A and Class C data may be unavailable on modern devices.
• With the passcode and a trusted acquisition path, full file system extraction may be possible on supported devices.

• Useful tools include Cellebrite UFED Cloud Analyzer, Oxygen Forensic Detective, Magnet AXIOM Cloud, and iMazing for limited consumer review.
• Apple legal process may return iCloud backup contents, iCloud Drive, Photos, Mail, Contacts, Calendars, Bookmarks, and Maps history.
• Advanced Data Protection greatly reduces what Apple can decrypt because many iCloud categories become end-to-end encrypted.

# Windows local backup location
C:\Users\[username]\AppData\Roaming\Apple Computer\MobileSync\Backup\

# macOS local backup location
~/Library/Application Support/MobileSync/Backup/

# libimobiledevice backup workflow
ideviceinfo
ideviceid -l
idevicebackup2 backup --full /path/to/evidence/backup/
idevicebackup2 list

sqlite3 Manifest.db "SELECT fileID, relativePath FROM Files WHERE relativePath LIKE '%sms%';"

# Mount a trusted device with ifuse
ifuse /mnt/ios_device/

# Review and copy media
ls /mnt/ios_device/
cp -r /mnt/ios_device/DCIM/ /evidence/photos/

• Checkm8 applies to A5 through A11 devices because the vulnerability is in bootrom hardware and cannot be patched by iOS updates.
• Forensic tools that use this class of workflow include Cellebrite UFED, Elcomsoft iOS Forensic Toolkit, Magnet AXIOM, and checkra1n-based approaches.
• Modern A12+ devices usually require the passcode and a supported agent-based extraction path.
• GrayKey is a restricted law-enforcement-only platform and should be discussed as context, not as a general student workflow.

# Install libimobiledevice on Ubuntu
sudo apt install libimobiledevice-utils

# Install on macOS
brew install libimobiledevice

# Common utilities
ideviceinfo
ideviceid -l
idevicebackup2 backup --full /path/to/backup/
idevicescreenshot screenshot.png
idevicesyslog

# iLEAPP
pip install ileapp
python ileapp.py -t fs -i /path/to/extracted_fs/ -o /path/to/output/

# APOLLO
git clone https://github.com/mac4n6/APOLLO
python apollo.py -o /output/ -m modules/ /path/to/extracted_db_files/

# SMS and iMessage
/private/var/mobile/Library/SMS/sms.db
# Tables: message, chat, handle, attachment

# Call history
/private/var/mobile/Library/CallHistoryDB/CallHistory.storedata
# Table: ZCALLRECORD

# Voicemail
/private/var/mobile/Library/Voicemail/voicemail.db

SELECT
  datetime(message.date/1000000000 + strftime('%s','2001-01-01'), 'unixepoch') AS date,
  handle.id AS contact,
  message.text,
  message.is_from_me
FROM message
JOIN handle ON message.handle_id = handle.rowid
ORDER BY message.date;

# Significant locations and routined data
/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite
/private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite

# Maps search history
/private/var/mobile/Library/Maps/GeoHistory.mapsdata

# Location services usage by app
/private/var/mobile/Library/LocationD/clients.plist

# App usage and screen time
/private/var/mobile/Library/Application Support/com.apple.remotemanagementd/RMAdminStore-Local.sqlite

# Spotlight searches
/private/var/mobile/Library/Spotlight/com.apple.Spotlight.index/

# Notifications
/private/var/mobile/Library/UserNotifications/[UUID]/store.sqlite3

# Photos metadata
/private/var/mobile/Media/PhotoData/Photos.sqlite

# Keychain, requires supported extraction and key access
/private/var/Keychains/keychain-2.db

# Apple ID accounts
/private/var/mobile/Library/Accounts/Accounts3.sqlite

# Known Wi-Fi networks
/private/var/preferences/com.apple.wifi.known-networks.plist

# WhatsApp
/private/var/mobile/Containers/Shared/AppGroup/[UUID]/ChatStorage.sqlite

# Telegram
/private/var/mobile/Containers/Data/Application/[UUID]/Documents/

# Signal, SQLCipher encrypted and requires key extraction
/private/var/mobile/Containers/Data/Application/[UUID]/Documents/database/signal.sqlite

# Snapchat
/private/var/mobile/Containers/Data/Application/[UUID]/Library/Caches/

# Chrome
/private/var/mobile/Containers/Data/Application/[UUID]/Documents/ChromeProfile/History

• SQLite rows may remain in free pages until overwritten.
• SQLite WAL files can preserve recent changes and deleted records.
• APFS copy-on-write behaviour may leave older data versions in unallocated areas or snapshots.
• Recovery depth depends heavily on acquisition type and encryption state.

# Check for SQLite companion files
ls -la /path/to/sms.db*
# sms.db
# sms.db-wal
# sms.db-shm

# Carve common media from an image
foremost -i ios_filesystem.dmg -o /output/ -t jpg,png,mov,mp4,pdf

# APFS local snapshots on a mounted volume
tmutil listlocalsnapshotdates

• File system MAC times: modified, accessed, and changed timestamps.
• SQLite timestamps, often stored as Cocoa time: seconds since 2001-01-01.
• EXIF timestamps and GPS metadata from photos and videos.
• Plist timestamps, notification timestamps, and app-specific time formats.
• Cloud sync timestamps and location history records.

import datetime

def cocoa_to_datetime(cocoa_timestamp):
    cocoa_epoch = datetime.datetime(2001, 1, 1)
    return cocoa_epoch + datetime.timedelta(seconds=cocoa_timestamp)

print(cocoa_to_datetime(715000000))

# Plaso / log2timeline for iOS backup artifacts
log2timeline.py --parsers ios_backup ios_timeline.plaso /path/to/backup/

# Export to CSV
psort.py -o l2tcsv -w timeline.csv ios_timeline.plaso

# Hash the extracted image
md5sum ios_filesystem.dmg > ios_filesystem.md5
sha256sum ios_filesystem.dmg > ios_filesystem.sha256

# Verify later
sha256sum -c ios_filesystem.sha256

• Who seized the device, when, and where.
• Device state at seizure: powered on/off, locked/unlocked, battery percentage, and network state.
• Every tool used, including version number and validation notes.
• Every command run, with timestamp and operator.
• Who had custody at each point and how the device was stored.
• Hash values of acquired images, backups, exports, and key evidence files.

• Executive summary with a non-technical overview of findings.
• Examiner qualifications and role.
• Evidence received, including device description, serial, IMEI where lawful, and condition.
• Tools used, methodology, and limitations.
• Findings with screenshots, artifact paths, timestamps, and interpretation.
• Timeline reconstruction and factual conclusions.
• Appendices containing raw data, hashes, exported tables, and tool logs.

Device found -> Is it on?
  NO -> Do not power on if passcode is unknown
        -> Use Checkm8 only if A11 or older and legally authorised
        -> Chip-off will usually remain encrypted

  YES -> Is it unlocked or in AFU state?
    YES -> Preserve power and network isolation
          -> Use trusted forensic acquisition workflow

    NO -> Is it A11 or older?
      YES -> Consider Checkm8-supported forensic extraction
      NO  -> Passcode, iCloud, existing backups, legal process, or restricted LE tools may be needed