New White Paper: Acquiring and Parsing Data from iOS 11 Devices

Over the past two years, Apple has steadily enhanced its iOS offerings designed for both security and user convenience. Each sub-version of both iOS 10 and 11 added or changed small features that have drastically changed the forensic workflow, making your job in some cases harder—and in other cases easier.

We’re offering a new best practice guide to help get the most evidence from smartphones running iOS 11. You’ll learn how to:

• Access more evidentiary data with new acquisition methods and tools, including GrayKey, biometric authentication, and even encrypted backups that you can create yourself.
• Look for data stored in new or different .plist and SQLite database locations, as well as entirely new datasets including .plists associated with the Do Not Disturb While Driving feature.
• Understand artifact changes, such as the new nanosecond timestamp format, Safari browser history, and new high efficiency photo and video file formats, that might affect how your forensic tool parses data.

This guide also includes information on the newly released iOS 11.4.1, which has significant changes for examiners.

iOS 12 will launch in the not too distant future, but past trends indicate that you can continue to expect to see iOS 11 devices in your lab for months to come. Get the practical insight you need to stay ahead of all the changes – download Acquiring and Parsing Data from iOS 11 Devices now!