Hello everyone,
It is probably old news to most of you, but I learned about the following technique for capturing iPhone data such as encrypted email content from my BlackLight certification training yesterday
https://
Basically the "Plan C" technique would be to use the QuickTime iPhone screen mirroring function to enable screenshot captures of content that one cannot normally extract from non-jail-broken iPhones such as email.
On a separate note, I highly recommend the BlackLight training course as I definitely picked up new information regarding Spotlight parsing and the importance of using HFS+ or APFS formatted drives for both forensic imaging and forensic analysis due to the fact that Mac specific metadata fields cannot be mapped to ExFat or NTFS drives and thus such critical metadata would be lost if one does not use HFS+ or APFS formatted drives; I had been advised of this fact a while ago, but the technical explanation I received in the training provided me with the Aha moment.
** Disclaimer I have no professional association with BlackBag Technologies, but I am a CBE and we use BlackLight in our practice as well as MacQuisition.
