iOS device triage and forensics
You examine a suspect iPhone from prepared evidence sets: you read backup and sysdiagnose contents, assess installed profiles, apps and crash records, scan with indicators and build a timeline.
Level 401 · 18 lessons · 15 practice labs
Lessons
Evidence sources
- Acquisition options on iOS: backup, sysdiagnose, cloud data
- Evidence integrity: hashes, notes and chain of custody
- The backup as evidence: what is in it and what is not
- The structure of a sysdiagnose archive
- The limits of a locked device and honest reporting
- Short task: write an evidence collection plan for an iPhone and verify the prepared set
System traces
- Installed apps, profiles and the management record
- Crash logs and analytics files
- Reading unified logs
- Data usage and process records: which process used the network when
- The shutdown log and traces of unusual processes
- Short task: find when a suspicious profile was installed and what it changed
Tools and the timeline
- Scanning a backup and sysdiagnose with MVT
- Reading an iLEAPP report
- Message, call and browser artefacts
- The timeline and the forensic report
- Short task: scan a training backup against an indicator list and interpret the result
Capstone
- Capstone: examine and report on a lawyer's iPhone after a suspicious link arrived
Practice labs
- Verify the evidence set against its hashes: Compare the given hash list with the files.
- Write an evidence collection plan for an iPhone: Write the order and authorisation needs for backup, sysdiagnose and cloud data.
- Report honestly what cannot be obtained from a locked device: Document with reasons what the available set covers and which data types fall outside it.
- List the installed profiles and their install dates: Read the profile listing in the evidence set.
- Find when a suspicious profile was installed and what it changed: Match the profile's payloads and install moment to the log.
- Trace a non-store app through the backup: Extract the app's install, signing identity and leftover files from the backup.
- Count the crash logs by process name: Group the records in the crash folder by process.
- Examine a time window in the unified log: Extract the processes that used the network in the given half-hour window.
- Find the unusual process in the data usage records: Compare process and data usage records and report the unknown name and its activity times.
- Produce an iLEAPP report and learn its sections: Process the training backup and find the installed apps section.
- Scan a training backup against an indicator list with MVT: Run the scan and interpret the matches.
- Confirm a tool match in the raw database: Find the MVT-flagged record in the relevant SQLite file and decide whether it is a false alarm.
- Put message and browser records in time order: Convert and merge the timestamps of the two sources.
- Build a timeline for a suspicious link: Order the message arriving, the link opening and the process activity after it.
- Write the forensic report for a lawyer's iPhone: Report the findings, timeline, limits and recommendations for the device at Sedirli Hukuk Bürosu.
About this course
You examine a suspect iPhone from prepared evidence sets: you read backup and sysdiagnose contents, assess installed profiles, apps and crash records, scan with indicators and build a timeline.
What you will learn
- Evidence sources
- System traces
- Tools and the timeline
- Capstone
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.