Apple's strategy over the past few years has shifted away from traditional computing. New and innovative ideas have been developed, disrupting the existing business model. In the music and video genre, several different applications and devices have been developed including the Apple TV, iTunes, and various iPod devices. The mobile category includes the iPhone, while the class of delivery channel items includes both iTunes for synchronization and downloads and the App Store. Finally, the development of the iPad (and previously the Newton device) falls within the Tablet category.

Many of these newer devices have been consolidated onto the iOS platform, with the exception of the Macintosh workstations, which are running OS X. There has been some debate in the past on whether Mac OS X will transform to iOS or perhaps a platform more similar to iOS. The Mac OS X Lion is to be released in the summer of 2011. This operating system is said to have similar qualities as the iOS devices, with the exception of a touch-screen feature. A Mac App Store was released in January of 2011, which enables Mac users to purchase software straight from their computer, similar to the way applications can be purchased through the iTunes App Store (Apple Inc., 2010).

As of 2009, the iPhone had taken third place in smart phone sales worldwide, which constituted 4.4% of the market share (McGlaun, 2010). During the first quarter of 2010 alone, 8.75 million were sold, which was more than half the number for the same period in 2009. Just prior to the release of the iPhone 4, over 50 million iPhones had been sold, and statistics from Q4 2010 show that Apple controlled 25% of the smart phone market in the United States (Slashdot, 2011). With the extreme popularity of the iPhone and the increasing number of devices sold, this mobile device has become one of the main focal points of many forensic investigations.

Apart from sales, the iPhone has an active hacking community, which has yielded research and tools that support forensic investigations. Some of these tools and techniques were originally used to assist with forensic imaging and are currently used for testing in order to better understand the device. Cydia is a popular application used for these purposes. It allows users with a modified phone to download and run iPhone or iPad applications that are not available in the App Store. More specifically, applications can be found here that may allow an examiner to better understand the iPhone file system and other data contents, such as Mobile Terminal. Jailbreaking, or modifying an Apple device, is not suggested, as it is not a forensically sound method; however, having the capability to remotely connect to a test device for educational purposes can be an invaluable learning experience for an examiner.

Another technique that is commonly used on the iPhone is referred to as “unlocking.” From 2007 to early 2011, AT&T was the only provider that offered service for the iPhone in the United States. In order to function properly, an AT&T SIM (subscriber identity module) card had to be placed into the device to identify itself on the carrier's network. In February 2011, the iPhone 4 became available through another carrier, Verizon. With the device being so exclusive and only available under these two carriers, many iPhone users search for other options. Unlocking an iPhone is a method that allows the device to be used on alternative networks, and various Apple tutorial sites, such as iClarified, provide steps on how to do this. The process typically involves installing an application, running it, and replacing the AT&T SIM card with that of a different carrier. As Verizon is on the CDMA (code division multiple access) network rather than GSM (global system for mobile communications), its version of the iPhone does not come with a SIM card. For this reason, unlocking the iPhone 4 from Verizon's network is impossible using the current methods. Having said that, the Apple user community will undoubtedly develop an alternative method in the future.

The Apple developer site is another resource that can benefit developers, examiners, or individuals interested in the iOS or OS X environments. Once a registered Apple developer, an individual can download Xcode and the iOS software development kit (SDK) to assist in application development. Included in this development suite are an Xcode integrated development environment (IDE), iOS simulator, and additional tools required for iPhone, iPad, and iPod touch application development.

Once the Xcode and iOS SDK are downloaded, the installer must be run in order to use the tools. Once installed, the tools and files shown in Figure 1.1 can be found in the following path: /Developer/Platforms/iPhoneSimulator.platform

One of the most useful tools within this package is the iOS simulator (as shown in Figure 1.2). This program allows the investigator to select an Apple device and version and use the simulator to test this particular model. For this example, the iPhone running firmware version 4.2 was selected. Among the other options were versions 3.2 (for the iPad) and 4.0.2 and 4.1 (for the iPhone). The software is memory intensive, so one can expect the testing to be a little slow. The simulator starts up with just a few general apps, including Photos, Settings, Game Center, Contacts, and Safari. The user is able to go into these apps, use them as though they were a real device, and even perform additional functions including Toggle In-Call Status Bar, Simulate a Memory Warning, Simulate a Hardware Keyboard, and Lock the device. Lacking from the simulator are some of the more common apps, such as SMS, Calendar, Camera, Notes, and the App Store in order to download additional applications.

The main purpose of the simulator is to be used by application developers in conjunction with Xcode. When Xcode is used to develop an iPhone or iPad application, the code can be tested and run using the simulator on various firmware versions. Testing on the simulator will ensure that the application is performing the way it is expected to.

The iPhone, like most complex electronic devices, is a collection of modules, chips, and other electronic components from many manufacturers. Due to the complex and varied features of the iPhone, the list of hardware is extensive. Table 1.3 consists of a list of many of the components of an iPhone 3G(s), including the manufacturer and model or part number.

The Samsung CPU is an RISC (reduced instruction set computer) processor that runs the core iPhone processes and works in conjunction with the PowerVR co-processor for graphics acceleration. The CPU is underclocked to 412 MHz (from a possible 667 MHz), presumably to extend battery life. Many of the internal components vary depending on the iPhone model. Semiconductor Insights is a significant resource in understanding the inner workings of many different types of devices. Their device library includes many mobile devices, including the iPhone. A report is completed for each device, which includes a description of the product, details on how to disassemble and reassemble the device, tear down photos, hardware components, and much more (Semiconductor Insights, n.d.).

The baseband is another essential component on the iPhone. The baseband manages all the functions that require an antenna, notably all cellular services. Unlocking the device was mentioned earlier. During this process, the baseband is the part of the device that is hacked in order to allow the iPhone to connect to a different cellular network. There are different baseband versions, which is why the unlocking process must constantly be modified. When a new device comes out, such as the iPhone 4, it will arrive with a different baseband version. The baseband version can be found under Settings > General > About > Modem Firmware, as shown in Figure 1.3.

The baseband processor has its own RAM and firmware in NOR Flash, separate from the core resources. It functions as a resource to the main CPU. The Wi-Fi and Bluetooth are managed by the main CPU, although the baseband stores their MAC addresses in its NVRAM.

The images displayed in the next page, courtesy of Semiconductor Insights, were taken after an iPhone 3G(s) was manually dismantled: Figure 1.4 is an image of the top of the device and Figure 1.5 is of the bottom.

Understanding the various types of mobile acquisition tools and the data they are capable of recovering is paramount for a mobile forensic examiner. A mobile device forensic tool classification system was developed by Sam Brothers, a computer and mobile forensic examiner and researcher, in 2007. The objective of his classification system is to enable an examiner to place cell phone and GPS forensic tools into a category, depending on the extraction methodology of that tool. This categorization facilitates the comparison between different tools and provides a framework for forensic examiners.

The classification tool is displayed in Figure 1.6. Starting at the bottom and working upward, the methods and tools generally become more technical, invasive, time consuming, forensically sound, and expensive (Brothers, 2007). Level 1 (Manual Extraction) involves simply scrolling through the data on the device as any user does in a traditional manner. Level 2 (Logical Analysis) is used by most investigators today, as it is only mildly technical and requires little training. Level 3 (Hex Dump) is where many forensic examiners have moved over the last 2–3 years, and it has been gaining quickly in popularity and support in the forensics community. Level 4 (Chip-Off) is the “new frontier” for most examiners, as formal training classes teaching this type of analysis have only just become available. Finally, Level 5 is rarely performed and is not well documented at this time, as it is extremely technical, very expensive, and highly time consuming.

It should be noted that there are pros and cons to performing analysis at each layer. The forensics examiner should be aware of these issues and should only proceed with the level of extraction that he/she has been trained to operate at. Evidence can be permanently destroyed if a given method or tool is not properly utilized. This risk increases the higher you move up in the pyramid. Thus, proper training is critical to obtaining the highest success rate in data extraction and proper forensic analysis of these devices (Brothers, 2007).

Each existing mobile forensic tool can be classified under one (or more) of the five levels. The following text contains a detailed description of each level as well as the methods that are used for data extraction at that given level (Brothers, 2007).

The following points break down the most commonly used acquisition techniques used on an Apple device. These methods may have some overlap with a couple of the levels discussed in the section on iPhone leveling, but will provide more details on the techniques and how they are used in conjunction with an iPhone.

While many of the commercial tools have been developed for Windows or Mac environments, the Linux platform deserves its own section, as it contains extremely powerful tools that can assist in a forensic investigation. Throughout the book, various hands-on exercises are performed to demonstrate to the user how a certain program or process is run. For example, forensic acquisitions are performed as well as various forensic tools run through a command prompt. Some tools make sense to run on a Mac workstation, while others are better performed on a Linux machine. Depending on the exercise, we will be jumping back and forth between operating systems, so be sure to note which platform is being used prior to following along. If you do not have a Linux or Macintosh workstation available, consider using a virtual machine to simulate the environment (building a Linux virtual machine is covered later in this section).