iOS Acquisition and Analysis

iOS forensics is shaped by a tightly integrated hardware security model.

• Secure Enclave (SEP) — isolated coprocessor holding key material; passcode attempts are rate-limited in hardware.
• Data Protection — per-file encryption keys tied to the passcode and device UID.
• Sandboxing — each app confined to its own container.

This means brute-forcing a passcode is throttled by the SEP, and a raw flash dump is ciphertext. Lawful access usually relies on the device being cooperatively unlocked or in an AFU state.

Every file is assigned a protection class that controls when its key is available.

• Complete — key wiped shortly after device locks (most protected).
• Complete Until First User Authentication — key available after first unlock (the common AFU default).
• No Protection — key always available (rare).

This is why AFU matters on iOS: files in the until-first-authentication class become readable, unlocking the bulk of user data.

The most accessible logical method is a backup acquisition via the host pairing relationship (same mechanism as iTunes/Finder).

• Requires a valid pairing record (lockdown certificate) and an unlocked device to create one.
• An encrypted backup (backup password set) actually includes more data: keychain, health, and saved passwords.

Create a backup using libimobiledevice with proper authorization:

An iOS backup does not store files by name. It hashes paths and stores them flat, indexed by a Manifest.db SQLite file.

• Manifest.db maps domain + relative path to the on-disk hashed filename.
• Info.plist / Status.plist hold device and backup metadata.
• Encrypted backups also require keychain key unwrapping with the backup password.

Locate a known artifact via the manifest:

A full file system (FFS) extraction goes beyond backup-allowed data to the entire user partition, including app caches, knowledge artifacts, and system databases.

• Requires an agent or exploit (e.g., checkm8-based on vulnerable older chips) and an AFU device.
• Captures artifacts backups exclude: knowledgeC.db, interactionC.db, location caches.

FFS is the gold standard for modern iOS analysis when lawfully obtainable, because it surfaces system behavioral databases invisible to a standard backup.

iOS stores user activity in well-known SQLite databases inside app domains.

• sms.db — iMessage and SMS (table: message, handle).
• CallHistory.storedata — call logs.
• AddressBook.sqlitedb — contacts.
• Photos.sqlite — media metadata and asset links.

Query iMessage content (read-only) from an extraction:

iOS frequently uses Apple/Cocoa epoch time: seconds since 2001-01-01 UTC, not 1970. Some databases store it as nanoseconds.

• Offset to Unix epoch is 978307200 seconds.
• iMessage date is nanoseconds since 2001; divide by 1e9 then add the offset.

Misreading the epoch produces dates 31 years off. Conversion pattern:

iOS keeps rich behavioral telemetry for system features that is invaluable for timelines.

• knowledgeC.db — app usage, focus, device lock/unlock, Siri events.
• interactionC.db — communication with contacts across apps.
• routined / cache_encryptedB.db — significant locations.

These exist only in FFS extractions (not standard backups) and can establish what the user was doing at a precise moment — but interpret carefully, as some events are system-generated, not user-driven.

The keychain holds Wi-Fi passwords, tokens, app credentials, and certificates. It is encrypted with class keys derived from the passcode.

• Recoverable from an encrypted iTunes backup (with the backup password) or an FFS extraction.
• Items carry their own protection class; some are only available AFU.

Keychain contents can reveal account access and lateral context — handle them with the same legal care as any credential material.

iLEAPP parses iOS backups and FFS extractions into structured reports, covering hundreds of artifact types.

• Decodes knowledgeC, sms, Safari history, app states, and more.
• Use it for triage; verify pivotal findings against the raw SQLite.

Run iLEAPP against a backup or extraction:

Data deleted from the device may persist in iCloud (backups, Photos, Messages in iCloud, app data).

• iCloud access requires separate legal authority and proper credentials/tokens.
• Cross-validate on-device findings against cloud copies and against a second tool.

As always, confirm the extraction hash before and after analysis, and document tool versions and commands so another examiner can reproduce your results.

You decode an iMessage timestamp as a Unix epoch and the date comes out 31 years too early. What went wrong?

You can now navigate the iOS forensic stack.

• The Secure Enclave + Data Protection classes make AFU state pivotal.
• Encrypted backups include keychain/health; FFS extractions add behavioral DBs.
• Backups are indexed by Manifest.db with hashed filenames.
• Core evidence: sms.db, CallHistory, AddressBook, knowledgeC.db.
• Decode Apple/Cocoa timestamps (2001 epoch, +978307200).
• Triage with iLEAPP, validate manually, and consider iCloud with proper authority.

Next: parsing app artifacts and producing the report.