In this section, we are going to break it down very similarly,
as we did in section 2, with the exception
of lock devices, which is moved later in the day.
We are going to start with the forensic overview,
and then we're going to talk about acquisition
considerations.
Acquiring iPhones is so much easier than Android.
We will then look at the file system structures
and break into those evidentiary locations
where you will do a two-part lab.
For evidentiary locations, remember, it's
the simple things-- the contacts, call logs, SMS,
browser, EXIF data, location searches, simple things
that most people should have on their iOS devices.
We are then going to talk about locked devices.
If you have a locked iPhone, chances of cracking it
or actually greater than an Android,
so this is something to consider.
And then we end with advanced traces
of decoding user activity.
In section 4, that is where we will
talk about backups and cloud.