as I said previously, acquiring an iPhone is pretty
cut and dry.
You don't have to do multiple methods if you get a full file
system acquisition.
If you don't, you may want to get more than one.
And we'll talk about what this looks like.
But let's start with physical.
Do you see how it's almost this pinkish color?
There is no current support for recent iPhones.
You are not going to get a physical acquisition.
If you come across an old iPhone 4
or something-- an iPhone 3GS, sure,
you can get a physical acquisition.
If you want to see what one looks like,
on iSO B of this course, you will have an iPhone 4 CDMA
device that's physically acquired
that you could look through.
I also included some documentation in the Dropbox
for you, should you ever see that.
If you get a physical extraction,
a few things to consider--
you are going to get raw binary images.
So you will have the system partition,
you will have a data partition.
But the second bullet here, may not
include encrypted unallocated space--
I want you to think about this.
Apple uses file-based encryption.
Every single user-created file is protected with a key.
If the user deletes that file, that file
goes into encrypted unallocated space.
Apple does not use garbage collection
to go and clean that up.
I think it's so we run out of space, but that's
my cynical thought there, and yet I keep buying into it.
You are not going to be able to get that.
So let's say you have a 256 gig iPhone 4.
If the user only has 19 gigs of allocated space or data
that's on that, your image would be 19 gigabytes.
And some people get freaked out by that,
because they're like, wait, it's supposed
to be first bit to last bit.
It should be 256.
Your acquisition is, but when you analyze it,
it's not going to show you encrypted unallocated space,
because there's no point.
There's nothing you can do to decrypt that.
There's no trick or anything beyond it.
Full file system-- you can see we
have the little jackpot here.
If you get a full file system acquisition,
you have everything you need.
You are going to be able to do so
much with your investigation.
It's fantastic.
You are going to see a full file system acquisition
at the end of section 3.
Part A is you're going to be using Physical
Analyzer to interact with it.
Part B is the tools we're taking away from you,
and you're going to run community scripts
to answer the same questions.
Advanced logical-- I honestly never do an advanced logical
on an iPhone.
What I would do is an encrypted iTunes backup.
And honestly, that's free.
It's your next best bet to full file system.
But you could do this.
It's up to you, if you want to.
If you do an advanced logical, you'll get the AFC--
which is Apple File Conduit--
you'll get lockdown service, backup service.
And it's really just zipping up your backup.