This training covers the forensic examination of iPhone, iPhone 3G, iPhone 3G[s], and iPhone 4 devices covering iPhone OS v1.x, v2.x, v3.x, and the new v4.0 software.
Training Overview
Using the tools and know-how provided in this 1-day workshop, you’ll work hands-on to recover stored and deleted information from the iPhone including:
- Keyboard caches containing usernames, passwords, search terms, and historical fragments of typed communication.
- Screenshots preserved from the last state of an application, taken whenever the home button is pressed or an application is exited.
- Deleted images from the suspect’s photo library, camera roll, and browsing cache.
- Deleted address book entries, contacts, calendar events, and other personal data.
- Exhaustive call history, beyond that displayed.
- Map tile images from the iPhone’s Google Maps application, lookups and longitude/latitude coordinates of previous map searches, and coordinates of the last GPS fix.
- Browser cache and deleted browser objects, which identify the web sites a user has visited.
- Cached and deleted email messages, SMS messages, and other communication with corresponding time stamps.
- Deleted voicemail recordings stored on the device.
- Pairing records establishing trusted relationships between the device and one or more desktop computers.
IMPORTANT NOTE
This is a Mac-only course. Be sure to bring a Mac notebook and an iPhone if you would like to learn hands-on. Do not bring live evidence or any data that cannot be at risk from classroom mistakes. To keep everything on track, the following classroom specifications will be used:
- Mac OS X 10.6
- iTunes 8.1.1
- [Optional] An iPhone
- iPhone 3G running v3.1.3 or earlier
- iPhone 3G[s] running v3.1.3 or earlier
- iPhone 4 running v4.0 *will work for logical acquisition, but not physical
iPHONE TRAINING DATES
- Sept 8, 2010 – Toronto, ON
- Sept 10, 2010 – Toronto, ON
View our training calender for complete information