iOS Forensics

What it is and why it matters

Apple makes the hardware, the operating system and the security chip, so every iPhone of a given model behaves the same way. That consistency helps the examiner, who faces far fewer variants than on Android. It also means that when Apple closes a route with a new iOS version, it closes for every device at once, and tool support becomes a matter of model and version pairs.

Every file on an iPhone is encrypted with its own key, wrapped by a class key that is in turn protected by the user's passcode and a key fused into the Secure Enclave. The passcode never leaves the device and the Secure Enclave slows down guesses. A locked iPhone that has not been unlocked since it was powered on is close to a sealed box. One that has been unlocked once keeps many keys in memory and can give a great deal more.

Inside, iOS is orderly. Messages, call history, contacts, photos, health data, application usage and location all sit in SQLite databases under known paths. App data lives in sandboxed containers with the same structure for every app. Once an extraction is in hand, the examiner's time goes into interpretation: which timestamp format, which protection class, which record came from iCloud and which was made on this device.

Types of digital evidence

Messages and Calls
sms.db under /private/var/mobile/Library/SMS with iMessage and SMS threads and attachments, and CallHistory.storedata with calls, FaceTime and app-based calls that register with the system.
Contacts, Photos and Media
AddressBook.sqlitedb, the Photos.sqlite database that records every picture with its location, edits, albums and sharing, and the media files themselves under /private/var/mobile/Media.
Usage and Pattern Databases
KnowledgeC.db under CoreDuet and the Biome stores that succeed it, recording app launches, screen state, charging, Bluetooth and dozens of other events with precise times.
Location Records
Significant locations held by the routined service, map and ride application histories, Wi-Fi known networks and the coordinates in photos.
Health and Device State
The Health database with steps, workouts and heart rate from a paired watch, which can show movement or stillness minute by minute, and power logs that show when the device was charged or in use.
Application Containers
Each app's data container and group container with its databases and caches. WhatsApp, Telegram, Signal, banking and payment apps all keep their records here, with protection classes chosen by the developer.
Browser and Account Data
Safari's History.db, tabs and downloads, the Keychain database with saved passwords and tokens and the accounts database listing every signed-in service.
Logs and Diagnostics
Unified log archives under /private/var/db/diagnostics, crash and diagnostic reports and the lockdown pairing records that show which computers the phone trusted.

Devices and data sources

iPhones and iPads in the lock state they were found in, with the model and iOS version recorded
Encrypted and unencrypted local backups on a computer, under MobileSync on a Mac or under Apple's folder in a Windows user profile
iCloud backups and synced data, obtained only through a separate legal process to Apple
Pairing records on a trusted computer, which can allow a backup of an unlocked-once device under authority
Apple Watch and other paired devices that mirror health, notification and message data
The SIM or eSIM profile and the carrier records it points to
Screenshots and photographs of the screen taken under authority when no extraction is possible
Older iPhones where a hardware-level route exists for the chip generation

How an examination runs

The order matters. Each step protects the one after it.

01
Authority and Isolation
Confirm the legal basis for the device and any accounts. Isolate it from networks at once. If it is unlocked, prevent it locking and consider enabling airplane mode under authority. If it is locked, keep it powered, because a reboot returns it to the before-first-unlock state.
02
Record Model, Version and State
Note the model, iOS version, lock type, whether the device has been unlocked since boot and whether a wired connection is still allowed. Check these against the tool's support matrix before touching the device further.
03
Pick the Extraction
On an unlocked device start with an encrypted backup-style logical extraction, which includes the Keychain and health data that an unencrypted backup omits. Move to a full file system extraction where the model and version pair is supported under a vendor-approved workflow.
04
Set the Backup Password Carefully
If a backup password must be set to obtain the richer encrypted backup, record the password used, the time and the authority, since this changes a device setting.
05
Hash and Keep the Tool Record
Hash the extraction container, keep the tool's log and version and store the raw files with the decoded report.
06
Decode and Verify
Parse the databases, convert Cocoa timestamps, read write-ahead logs and check that decoded conversations match the raw rows. Note which records were synced from iCloud or another device rather than created here.
07
Report the Reach
State the extraction level, the protection classes that stayed sealed, the apps not decoded and the cloud data that would need a separate process.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Data Protection: Apple's per-file encryption scheme. Each file has its own key, wrapped by a class key, and the class keys are protected by the passcode and the hardware key in the Secure Enclave.
Protection Classes: Levels such as Complete Protection, Protected Unless Open, Protected Until First User Authentication and No Protection. They decide when a file's key is available and therefore what an extraction can read in each lock state.
Secure Enclave: The isolated security processor that holds the device key, derives passcode-related keys and enforces delays between passcode attempts. It is why brute force is not a practical route.
Before First Unlock: The state after a reboot and before the passcode is entered. Most class keys are unavailable and extractions return very little. Recent iOS versions restart a locked device on their own after a period of inactivity, returning it to this state.
Lockdown Record: The pairing file created when the phone trusts a computer. With it, a tool can request a backup from an unlocked-once device without the passcode, which is why trusted computers are seized with the phone.
Encrypted Backup: A backup protected by a user-set password. It contains Keychain items, Safari history, health data and call history that an unencrypted backup leaves out, which makes it the richer logical extraction.
Full File System Extraction: A copy of the decrypted user file system obtained through elevated access on supported model and version pairs. It includes app containers, logs and usage databases that no backup contains.
Cocoa Timestamp: Seconds since 1 January 2001, used across Apple databases, sometimes with fractional seconds or in nanoseconds. Converting it wrongly moves events by decades.
Advanced Data Protection: An optional iCloud setting that end-to-end encrypts most backup and synced data, so that Apple itself cannot provide the content to a lawful request.

Challenges and limits

What makes it hard

A locked device before first unlock is largely sealed, and no passcode-guessing route is practical against the Secure Enclave's limits
Tool support is tied to model and iOS version pairs and shrinks with every update, so a device updated after seizure can lose a route that existed
Wired data connections are blocked after a period of lock, so a device left untouched may refuse a connection it would have accepted earlier
Physical extraction of the storage is not possible on modern iPhones, since the flash holds only ciphertext keyed to the chip
Much data is synced from iCloud or another Apple device, and the report must say which records this device actually created
Advanced Data Protection and separate legal process put iCloud data out of reach of the device examination
Apple's rapid changes to databases and the shift from KnowledgeC to Biome leave tool decoding uneven between versions

Keeping the evidence intact

Keep a locked device powered and isolated so that it does not reboot into the before-first-unlock state or receive a wipe command
Record the lock state, the time since the last unlock where known and every passcode entry made under authority
Document any setting changed to obtain an extraction, such as a backup password, with the time and the reason
Hash the extraction container and verify key records against the raw SQLite rows and their write-ahead logs
Seize and record the trusted computer and its pairing records with the phone, under the same custody

Standards and legal considerations

NIST SP 800-101 Rev. 1
Guidelines on Mobile Device Forensics, which frame the extraction hierarchy and the handling of locked and encrypted handsets.
Read the guide
ISO/IEC 27037:2012
The collection and preservation guideline, with the principle that the least invasive adequate method is used and every action is recorded.
Read the guide
SWGDE Best Practices
SWGDE guidance on mobile device evidence and on the validation of extraction tools whose output will be relied on in court.
Read the guide
Information Technology Act 2000
The Indian statute under which electronic records and the offences investigated through phone evidence are framed.
Read the guide

In practice

The Encrypted Backup That Held the Answer
An unlocked iPhone is seized in a cheating-at-work case. A full file system route does not exist for its model and version. The examiner sets a backup password under authority, takes an encrypted backup and recovers the Keychain, call history and Safari records that the plain backup would have omitted, including a shared login to the rival's portal.
Stillness at the Time of the Call
A suspect says they were driving when an incriminating message was sent. The Health database shows no steps for two hours, the power log shows the device charging and KnowledgeC shows the messaging app in the foreground at the moment of sending, all on the device itself rather than synced from elsewhere.
A Device That Rebooted in Storage
A locked iPhone seized after first unlock is left in an evidence store for several days before examination. By then it has restarted on its own and is in the before-first-unlock state, and the route that would have worked is closed. The examiner documents the loss and the laboratory changes its intake procedure.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

MobileMobile & IoT ForensicsiOS ForensicsBFU and AFU states, iTunes and Finder backups, the keychain and iLEAPP for iPhone casesIntermediateDCMFE

NetworkNetwork & Cloud ForensicsCloud Storage InvestigationCollect and read AWS, Microsoft 365 and Google Workspace logs as sound evidence.IntermediateCloud / Network

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

Standards for this area

NIST SP 800-101 Rev. 1NIST SP 800-101 Rev. 1 is the reference most mobile forensic procedures trace back to. It gives the tool classification pyramid, the preservation routine and the acquisition rules that laboratories still follow.Standard

Careers that use it

Mobile Forensic Analyst

Questions people ask

Can a locked iPhone be opened?

It depends on the model, the iOS version, whether it has been unlocked since boot and what lawful routes the laboratory has. Some combinations allow a full file system extraction, many allow little. Nobody can promise a result before checking the device against a current support matrix.

Why should the user's computer be seized with the phone?

Because it may hold a pairing record that lets a tool take a backup from an unlocked-once phone without the passcode, and because local backups on the computer may hold older versions of the data.

Is iCloud data part of the phone examination?

No. Tokens and settings on the phone show which iCloud services are in use, but the content sits with Apple under a separate legal process, and with Advanced Data Protection on, Apple cannot read it either.

What is the difference between an encrypted and an unencrypted backup?

An encrypted backup includes the Keychain, Safari history, call history and health data. An unencrypted one leaves them out. For that reason examiners prefer the encrypted form, setting a known password under authority if none is set.