Chapter 2. Understanding the Internals of iOS Devices

As of September 2013, Apple had sold more than 550 million iOS devices (170 million iPads and 387 million iPhones) according to released sales records. While iOS is the leading operating system for tablets worldwide, Android continues to be the leading operating system for smartphones worldwide. The following screenshot represents the worldwide mobile/tablet operating system share from 2013 to 2014 according to https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=9&qpcustomb=1:

Regardless of the statistics, if you are a forensic examiner, chances are you will need to conduct an examination of an iOS mobile device.

In order to perform a forensic examination on an iOS device, the examiner must understand the internal components and inner workings of that device. Developing an understanding of the underlying components of a mobile device will help the forensic examiner understand the criticalities involved in the forensic process, including what data can be acquired, where the data is stored, and what methods can be used to access the data from that device. So, before we delve into the examination of iOS devices, it is necessary to know the different models that exist and their internals.

This book primarily focuses on the iPhone and forensic techniques associated with it. However, the same techniques may be applied to other Apple devices, such as the iPod Touch, iPad, and Apple TV.