iPhone Backup Files

If you dont have the iOs device this does not mean your case is over!  Many times when I have been asked to examine an iPhone data has been removed prior to my examination.  When this happens I will always instruct my client to consider the iPhone backup files created by iTunes.  When a connection is made to iTunes, iTunes will automatically create a backup of the device.  Most users dont realize what is taking place and often are not concerned.

 Typically the data I have been asked to provide to my client when I have performed an exam is stored in these backup's.  With the proper tools and training an examiner can examine the backup file and produce a report on the data backed up from the iOs device.  I recently examined an iPhone and was only able to recover 50 text messages, when I examined the backup file from this iPhone I was able to recover over 10,000 text messages. This is a perfect example of why this backup file is so valuable.