Understanding the Internals of iOS Devices

In October 2017 alone, Apple sold more than 170,000 iPhones and more than 33,000 iPads according to released sales records. While iOS is the leading operating system for tablets worldwide, Android continues to be the leading operating system for smartphones worldwide. Regardless of the statistics, if you are a forensic examiner, the chances are that you will need to conduct an examination of an iOS device.

In order to perform a forensic examination of an iOS device, the examiner must understand the internal components and inner workings of that device. Developing an understanding of the underlying components of a mobile device will help the forensic examiner understand the criticalities involved in the forensic process, including what data can be acquired, where the data is stored, and what methods can be used to access the data from that device. So, before we delve into the examination of iOS devices, it is necessary to know the different models that exist and their internal components. Throughout this book, we will perform forensic acquisition and analysis on iOS devices, including the iPhone, iPad, and Apple Watch.

The goal of this chapter is to introduce you to the iOS device technology. We will cover details that may often get overlooked, but will help you during your forensic investigation. You must understand the different iOS devices and how data is stored on the devices before you can successfully extract it.

In this chapter, we will cover the following topics in detail:

• iPhone models and hardware
• iPad models and hardware
• Apple Watch models and hardware
• iOS overview
• HFS Plus overview
• APFS overview
• Jailbreaking