Summary

The first step in a forensic examination of an iOS device should be identifying the device model. The model of an iOS device can be used to help the examiner develop an understanding of the underlying components and capabilities of the device, which can be used to drive the methods for acquisition and examination. Legacy iOS devices should not be disregarded, because they may surface as part of an investigation. Examiners must be aware of all iOS devices, as old devices are sometimes still in use and may be tied to a criminal investigation. The next chapter will provide tools that will aid in obtaining data from iOS devices to later forensically examine. Not all tools are created equally, so it's important to understand the best tools to get the job done properly.