DIGITAL FORENSIC ANALYSIS OF IPHONE

Abstract

iPhone is always under the scrutiny of mobile and computer hackers because of its popularity and the diverse set of tasks it is able to perform. However, the purpose of the scrutiny is always to reveal the internal functionality of the iPhone and to circumvent the protection mechanism. No comprehensive work has been done in the forensic investigation of the iPhone. The usage of smart phones in criminal cases is not uncommon phenomenon and several case studies show that criminals are using the easily available encryption and steganography tools built in these smart phones for criminal purposes and for hiding the evidence. Smart phones are also reportedly used in computer and wireless hacking and cracking incidents. Security researchers regularly demonstrate usage of all the popular hacking tools through iPhone in different security conferences. This indicates the way network and other sensitive infrastructure will be attacked by people in the near future and the reason that the attach methods are available to everyone having an Internet connection makes it even more dangerous. Using small devices that can be hidden inside a pocket to launch sophisticated attacks against organizational infrastructure, it is possible to compromise the security system of an organization sitting inside the same organization without anyone’s notice. The main focus of this research is to analyze iPhone for the purpose of forensic investigation. We will design tools and forensic procedures that can extract and analyze data stored on the iPhone. The procedures outlined in this research can work on any iPhone firmware models, from version 3.1.3 to the latest firmware version 4.3.0 with little or no modification to the underlying code of the investigation toolkit. Further, architecture of the toolkit is such that no component is dependent on another. All components work in isolation; therefore, adding additional functionality is not a problem. All research work and findings are tested on iPhone firmware version 3.1.3. Validation and verification of the findings clearly demonstrated the effectiveness of the procedures and can be reviewed and analyzed independently through the custom developed open source forensic investigation toolkit that is also part of this research activity.