When Apple released iOS 8.3, examiners immediately saw a dramatic difference in the amount of data available for examination after an acquisition. Due to Apple's commitment to security on iOS devices, application Library folders are now largely protected from acquisition. These Library folders are where most data from users is saved. The changes with iOS 8.3 that could significantly affect examinations were covered in a previous blog entry.
However, as nothing speaks louder than pictures, here are two screenshots to show a comparison. The first screenshot shows the data available from a device running iOS 8.2, and the second screenshot depicts the data collected from the same device running iOS 8.3.
BlackLight view of an application folder - iPhone running iOS 8.2
BlackLight view of the same application folder - iPhone running iOS 8.3
There is obviously a marked difference in the amount of data available to the examiner with iOS 8.3. Essentially, this means that going forward the process of analyzing an iOS device is going to have to change, in that the examiner may need to supplement the acquisition of the device with screen captures in order to record user settings and data.
Now you know.
Need more? Contact BlackBag Technologies' training team today for more information, or to register for a seat in one of our upcoming classes.