Summary

The first step in the forensic examination of an iOS device should be identifying the device model. The model of an iOS device can be used to help you as the examiner develop an understanding of the underlying components and capabilities of the device, which can be used to drive the methods for acquisition and examination. Legacy iOS devices should not be disregarded, because they may surface as part of an investigation. You must be aware of all iOS devices, as old devices are sometimes still in use and may be tied to a criminal investigation.

The next chapter will provide tools that will aid in obtaining data from iOS devices to later forensically examine. Not all tools are created equal, so it's important to know the best tools to get the job done properly.