Tips & Tricks // Acquiring and Parsing Sysdiagnose Log Archives from iOS Devices in AXIOM
When full file system acquisitions are not available for iOS devices, several key artifacts will be missed from examinations. In order to obtain several of these key pieces for investigation, examiners should understand how to capture log files from the device as well as techniques to extract and analyze them. This presentation will discuss ways to generate and then extract sysdiagnose log archives and load them into AXIOM. Once inside AXIOM examiners will learn what can be parsed using artifacts that already exist as well as ways to extend this data with open source tools.