This training covers the forensic examination of iPhone, iPhone 3G, iPhone 3G[s], and iPhone 4 devices covering iPhone OS v1.x, v2.x, v3.x, and the new v4.0 software.
Training Overview
Using the tools and know-how provided in this 1-day workshop, you’ll work hands-on to recover stored and deleted information from the iPhone including:
- Keyboard caches containing usernames, passwords, search terms, and historical fragments of typed communication.
- Screenshots preserved from the last state of an application, taken whenever the home button is pressed or an application is exited.
- Deleted images from the suspect’s photo library, camera roll, and browsing cache.
- Deleted address book entries, contacts, calendar events, and other personal data.
- Exhaustive call history, beyond that displayed.
- Map tile images from the iPhone’s Google Maps application, lookups and longitude/latitude coordinates of previous map searches, and coordinates of the last GPS fix.
- Browser cache and deleted browser objects, which identify the web sites a user has visited.
- Cached and deleted email messages, SMS messages, and other communication with corresponding time stamps.
- Deleted voicemail recordings stored on the device.
- Pairing records establishing trusted relationships between the device and one or more desktop computers.
IMPORTANT NOTE
This is a Mac-only course. Be sure to bring a Mac notebook and an iPhone if you would like to learn hands-on. Do not bring live evidence or any data that cannot be at risk from classroom mistakes.
2011 iPhone Forensics TrainingView our training calender for a complete list of scheduled trainings.
viaForensics can provide group trainings tailored to your organization, on-site or at a conference. Contact us for more information.
