iPhone Backup Files
If you dont have the iOs device this does not mean your case is over! Many times when I have been asked to examine an iPhone data has been removed prior to my examination. When this happens I will always instruct my client to consider the iPhone backup files created by iTunes. When a connection is made to iTunes, iTunes will automatically create a backup of the device. Most users dont realize what is taking place and often are not concerned.
Typically the data I have been asked to provide to my client when I have performed an exam is stored in these backup's. With the proper tools and training an examiner can examine the backup file and produce a report on the data backed up from the iOs device. I recently examined an iPhone and was only able to recover 50 text messages, when I examined the backup file from this iPhone I was able to recover over 10,000 text messages. This is a perfect example of why this backup file is so valuable.