The agenda for this section is laid out as follows.
We're going to look at backup file forensics.
What does this mean to you?
We are going to look at locked iOS backup files,
and how can you crack them?
Is there anything else you can do to get rid of that passcode
if it's hindering your analysis?
We are then going to look at iCloud extractions.
During these three sections, you're going to have two labs.
The first lab is actually going to be a backup file.
The second lab is going to be a database recovered
from a backup file where a change has taken
place due to an iOS upgrade.
You are going to figure out what changed
and modify that query to make the query work to provide you
with artifacts that you can analyze.
So let's get started with backup file forensics.