There are two types of files on an IOS device: user and system files. System files should not be alarmed since most of the data stored by the system is not of a direct interest to the investigator for a forensic analysis. However, there are some files that need to be presented to the investigator because they contain pertinent information.
The first file we are going to show, is the calendar application. The content of the calendar application could provide the user’s standard history of events including the date, time and its description. Furthermore, it could contain traces and geolocation data. The calendar application is found in the /Applications/Calendar.app/ directory.
The next file we would be showing is the Contacts application. It is a standard application found in the /Applications/Contacts.app/ directory that provides storage of phone numbers, addresses and email addresses. It contains the information which could be useful for investigator in cases involving a missing phone, missing emails or information.
The next application we are going to show is the Notes application, which is just a Notes pad. The Notes application could be used for storing the text messages, emails, blogs and other notes. It provides simple text boxes and its content could be saved to XML format.
The next file which would be presented is the Library with internal storage application. It allows the user to access all the applications installed on the device. It contains user data, configuration information and other data which could be used in the investigation. d2c66b5586