
iOS Forensics for Investigators
By :

We will focus on two tools: a commercial tool, Cellebrite Physical Analyzer, and a free tool, Apollo.
Cellebrite Physical Analyzer automates the task of analyzing location data by displaying GPS, cellular, and Wi-Fi locations in a unified view. Keep in mind that, to access location data, you will need to perform a full filesystem acquisition, as the files of interest are not available in a logical or iTunes backup.
To view location data, from the menu on the left side, choose Location Related | Device Locations | Native Locations:
Figure 6.10 – Viewing location data in Physical Analyzer
The following figure shows the remaining columns in detail:
Figure 6.11 – Physical Analyzer specifies the source file for the artifact
As you can see from the preceding figure, for each record, Physical Analyzer will specify the source file...
Change the font size
Change margin width
Change background colour