Volume 17 , Issue 2 , PP: 167-177, 2026 | Cite this article as | XML | Html | PDF | Full Length Article
Robinson Tombari Sibe 1 * , Adewale Alayegun 2
Doi: https://doi.org/10.54216/JCIM.170212
The growing popularity of iOS devices and the increasing complexities of forensic investigation of these devices requires more research attention. Due to the complex encryption and closed nature of iPhones, it is inherently complicated to perform digital forensic investigations. While there are many extraction and analysis methods for iphone, the most comprehensive (but most complex) is the full physical acquisition. However, the likelihood of acquiring physical extraction of an iPhone is becoming more challenging as Apple improves on its mobile technology, with more emphasis on privacy and security. Factors such as the adoption of full file and disk encryption, and secure enclave technology poses serious challenge to forensic investigators. This paper explored alternatives, by extracting and analyzing valuable evidential artifacts using iTunes and iCloud, unique to the iOS environment. This research involved the forensic examination of an iPhone XR running on iOS 17.5, using Oxygen Forensic Device Extractor v2.13.1, with each step documented. The study uncovered several artifact locations and provided a brief description of each, and their usefulness in a forensics analysis. Some of these include user-generated content, system artifacts, application data, and cloud interactions, such as contacts, SMS data, call history, media files, database, browser data, application data and others, that could prove vital in solving a case. This study made valuable contribution to the body of knowledge by highlighting specific challenges faced in iOS forensics and recommending a methodical approach to examining and analyzing evidential artifacts using iTunes and iCloud. The paper also addressed the gap in available literature in iOS forensics.
Digital Forensics , Mobile Forensics , iOS Forensics , iOS , Forensic Acquisition , Cybersecurity , Digital Investigation , iTunes , iCloud
[1] O. W. Samuel and A. Al-Nemrat, "Towards a taxonomy for mobile forensics," in Proc. 2013 IEEE/ACM Int. Conf. Adv. Social Netw. Anal. Mining, Ontario, Canada, Aug. 25, 2013.
[2] Apple Inc., Apple security releases. Available: https://support.apple.com/en-us/HT201222 (Accessed: Nov. 8, 2024).
[3] V. Avancha, "Comparison of forensic acquisition and analysis on an iPhone over an android mobile phone through multiple forensic methods." Available: https://repository.stcloudstate.edu/cgi/ viewcontent.cgi?article=1125&context=msia_etds (Accessed: Nov. 5, 2024).
[4] R. Ayers, S. Brothers, and W. Jansen, NIST.SP.800-101r1 - Guidelines on mobile device forensics. Available: https://doi.org/10.6028/NIST.SP.800-101r1 (Accessed: Nov. 9, 2024).
[5] R. Ayers, B. Livelsberger, and B. Guttman, NIST SP 800-202 Quick start guide for populating mobile test devices. Available: https://doi.org/10.6028/NIST.SP.800-202 (Accessed: Nov. 9, 2019)
[6] V. Baryamureeba and F. Tushabe, "Mobile phone forensics: a challenge to the future of cybercrime investigation," in Proc. Int. Conf. Adv. Comput., Control, Telecommun. Technol., 2010.
[7] Belkasoft, Acquiring iOS devices. Available: https://belkasoft.com/iOS. (Accessed: Nov. 14, 2024)
[8] Carrier, File System Forensic Analysis. Boston, MA, USA: Addison-Wesley, 2005.
[9] Casey, Digital evidence and computer crime: Forensic science, computers and the internet. Massachusetts, MA, USA: Academic Press, 2011.
[10] T. C. Chang and Y. Li-Min, "Digital forensics security analysis on iOS devices," J. Web Eng., vol. 20, pp. 775-794, 2021.
[11] Counterpoint Research, Global smartphone market share: quarterly. Available: https://www.counterpointresearch.com/insights/global-smartphone-share/ (Accessed: Nov. 5, 2024)
[12] S. Garfinkel, iPhone and iOS forensic: Investigation, analysis and mobile security for Apple iPhone, iPad and iOS Devices. J. Digit. Forensics, Security Law, vol. 8, pp. 65-67, 2013.
[13] Hosmer, Investigating Digital Crime. Oxford, United Kingdom: Syngress, 2016.
[14] International Telecommunication Union, Statistics. Available: https://www.itu.int/en/ITU-D/Statistics/Pages/stat/default.aspx (Accessed: Nov. 4, 2024)
[15] S. Kanarachos, V. Kouliaridis, and G. Kambourakis, "Mobile forensic investigation: A review of malware detection techniques and approaches," Future Gener. Comput. Syst., vol. 78, pp. 1146-1157, 2018.
[16] H. Koganti and G. Rao, "Forensic acquisition of IOS devices," Int. J. Recent Technol. Eng., vol. 8, 2019.
[17] R. Mangalampalli, "The apple of the world: extracting evidential data through iphone," Culminating Projects Inf. Assurance, vol. 96, pp. 2-23, 2019.
[18] M. Alomari et al., "Mobile investigation: forensics analysis of iOS devices." Available: 10.13140/RG.2.2.16584.60169 (Accessed: Nov. 5, 2024).
[19] NIST, Computer forensics tool testing program (CFTT). Available: https://www.nist.gov/itl/ssd/software-quality-group/computer-forensics-tool-testing-program-cftt (Accessed: Nov. 15, 2024)
[20] J. Paglierani, M. Mabey, and G. J. Ahn, "Towards comprehensive and collaborative forensics on email evidence," in Proc. 9th IEEE Int. Conf. Collaborative Comput.: Netw., Appl. Worksharing, Austin, Texas, Oct. 20, 2013.
[21] M. Piccinelli and P. Gubian, "Exploring the iPhone backup made by iTunes," J. Digit. Forensics, Security Law, vol. 6, pp. 31-62, 2011.
[22] O. Afonin, "The future of mobile forensics." Available: https://www.proquest.com/trade-journals/future-mobile-forensics/docview/1695022347/se-2. (Accessed: Nov. 9, 2024)
[23] Reilly, Digital forensics for handheld devices. Boca Raton, FL, USA: CRC Press, 2015.
[24] R. Sang and K. Yun, "iLEAPP: iOS Logs, Events, and Properties Parser," in Proc. 2020 ACM Asia Conf. Comput. Commun. Security, Taipei, Taiwan, Jun. 1, 2020.
[25] R. T. Sibe and C. Kaunert, "Digital evidence, digital forensics, and digital forensic readiness," in Cybercrime, Digital Forensic Readiness, and Financial Crime Investigation in Nigeria. Switzerland: Springer Nature, 2024, pp. 57-83.
[26] Statista, Market share of mobile operating systems worldwide from 2009 to 2025, by quarter. Available: https://www.statista.com/statistics/272698/global-market-share-held-by-mobile-operating-systems-since-2009/ (Accessed: Nov. 8, 2024)
[27] Statista, Number of smartphone mobile network subscriptions worldwide from 2016 to 2023, with forecasts from 2023 to 2028. Available: https://www.statista.com/statistics/330695/number-of-smartphone-users-worldwide/ (Accessed: Nov. 4, 2024)
[28] Y. Vasserman, M. Ganor, and J. Yen, "iOS forensic research," Adv. Digit. Forensics XIII, pp. 137-160, 2017.
[29] S. Zawoad and R. Hasan, "Towards practical cloud forensic investigation," in Proc. 2015 IEEE/ACM 8th Int. Conf. Utility Cloud Comput., Limassol, Cyprus, Dec. 7, 2015.
