Let's take it back to iOS 13.
So iOS 13 changed the game.
Major things came into play.
IOS 14 added some new changes.
iOS 15 added some new changes.
But with these three versions, backing up your encryption,
or encrypting your backup, encrypting your extraction
really, really matters.
If you do not encrypt the backup,
you are going to miss massive amounts of data.
If you go to smarterforensics.com,
I have a blog that--
the naming of this blog could not have been better to win
a Forensic 4:cast Award, because it's called Won't You Back that
Thing Up?
And it's about encrypting your backup.
It tells you on iOS 13 all the things
you need to care about, what you will miss if you don't encrypt
your backup.
For iOS 13, this is the first time
that Apple started restricting if users
could update their iPhones.
So if you see an iPhone that's older than a 6S,
it will not have 13, 14 or 15 on it.
It's not capable of it.
So you could potentially have to see older iOS versions.
Your cheat sheet is specific to iOS version,
so make sure you pay attention to that.
If the user changes their iCloud Settings, starting with iOS 13,
it will impact your investigation.
I'm going to show you what I mean by that.
But the good news is things that were harder in iOS 12, 11,
and 10 are back on the device, so we're
getting that information back.
We have some file path changes, but we will always
adapt, adjust, and move forward with these iOS changes.