Lance Mueller of Magnet Forensics earlier posted an article on iOS forensics detailing common steps and details of an examination of an iOS device, and how IEF can be used once you have that physical image or file system dump.
In this new article, Jad presents some examples of the deleted data IEF Advanced is able to recover from iOS physical images. This is one of Magnet Forensics’ key strengths on mobile (and PC/Mac) images and he thinks you’ll be excited about some of the artifacts they’re able to recover that you may have been missing using other mobile forensic tools. But first, some background. The following data is from an iPhone 3G that was factory reset. A cursory look at the phone would yield no results and it would seem as though this is a fresh phone with no data on it, but as you’ll see, there are lots of goodies to be found…
