Therefore, this paper presents scenario-based methods of forensic analysis for a specific third-party social networking service application on a specific mobile device. For these reasons, forensic investigators experience difficulties in finding the locations and meanings of data during digital investigations. However, most mobile operating systems are now updated on a frequent basis, and developers are constantly releasing new versions of them. Digital forensics of mobile third-party applications can provide important evidence to forensics investigators. Nowadays, third-party applications form an important part of the mobile environment, and social networking applications in particular can leave a variety of user footprints compared to other applications. Our recommendations for updating the forensic data extraction tools is based on the observation of schema changes found in successive iOS versions. Our focus in this paper is to analyze the SQLite schema evolution specific to iOS and assist forensic tool developers in keeping their tools compatible with the latest iOS version. Android/iOS devices generally use SQLite databases since it is a lightweight database.
Directories in the iOS backup contain SQLite databases, plist files, XML files, text files, and media files. Moreover, approximately once every couple years, there could be a major iOS release which can cause the reorganization of files and folders in the iOS backup. Both these reasons can cause significant changes in the way user data gets stored in the iOS backup files. Many iOS application developers release periodical updates to iOS mobile applications. This is due to the fact that the iOS operating system is frequently updated by Apple Inc. A significant challenge faced by several forensic tool developers is the changes in the data organization of the iOS backup. Particularly, the iOS backup (obtained through a logical acquisition technique) is widely used by many forensic tools to sift through the data. Files in the backup of iOS devices can be a potential source of evidentiary data.
0 kommentar(er)
