iPhone Forensics: Recovering Investigative Evidence using Chip-off Method

Smartphone And Its Taxonomy

Today Smartphone devices are widespread and they hold a number of types of information about the owner and their activities. As a result of the widespread adoption of these devices into every aspect of our lives they can be involved in almost any crime. The aim of digital forensics of Smartphone devices is to recover the digital evidence in a forensically sound manner so that the digital evidence can be forensically presentable and accepted in court. The digital forensic process consists of four phases, which are Preservation, Acquisition, Examination/Analysis and final Presentation. In this paper, we look at various types of smartphone formats and their associated digital evidence. The digital forensics process of the Smartphone devices is discussed and, this paper also contains recommended guidelines and procedures for how to perform the phases of the digital forensics process on Smartphone devices using the chip-off technique.

A smartphone contains much of the functionality of a desktop PC (Personal Computer), but it also includes radio communications capabilities that desktop PCs typically lack. Communication functionalities include GSM/CDMA (Global System for Mobiles / Code Division Multiple Access) radio, NFC (Near Field Communications), GPS (Global Positioning System), Wi-Fi and Bluetooth communication. The high mobility of these devices can be the most important factor in the shift from desktop/laptop computer to smartphones. Unlike laptops or desktop computers, a smartphone can easily fit in a pocket. It is a computer that is easy to use and small enough to be used almost anywhere. A user can browse the Internet, check email, use GPS navigation, and make online payments from personal bank accounts. Hence, a device this capable is also likely to contain personal user data.

There are various ways a user can protect his or her personal information on smartphones. Android and iOS (Operating System) phones can be set up by means of authentication login and password protected application access. Some phones include a data encryption method to protect sensitive data. Also, third-party mobile protection/encryption software can be installed on both Android and iOS phones. The iPhone has hardware encryption enabled by default for all data stored in memory. There is also a Data Protection API (Application Program Interface) provided by Apple that can be used to implement application-level encryption.