/IOS-forensics-tools-explanations-links-security-Publications-manuals-

MIT LicenseMIT

IOS-forensics-tools-explanations-links-security-Publications-manuals-reports-applications data analysis-Device hardening:

more to come :

-1-Guidelines on Mobile Device Forensics:

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-101r1.pdf

-2-Guidelines for Managing the Security of Mobile Devices in the Enterprise:

http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-124r1.pdf

-3-Technical Considerations for Vetting 3rd Party Mobile Applications (Draft):

http://csrc.nist.gov/publications/drafts/800-163/sp800_163_draft.pdf

-4-iOS Forensic:

https://wiki.cis.unisa.edu.au/wki/images/7/7c/DORAZIO_iOS_Forensics_Final_Revise.pdf

-5-iOS Forensics Investigative Methods:

http://www.zdziarski.com/blog/wp-content/uploads/2013/05/iOS-Forensic-Investigative-Methods.pdf

-6-SIM and USIM Filesystem, A Forensics Perspective:

https://www.researchgate.net/publication/220998796_SIM_and_USIM_filesystem_a_forensics_perspective

-7-A Hypothesis-based Approach to Digital Forensic Investigations, Brian Carrier, CERIAS Tech Report 2006-06:

https://www.cerias.purdue.edu/assets/pdf/bibtex_archive/2006-06.pdf

-8-A Road Map for Digital Forensic Research:

http://www.dfrws.org/sites/default/files/session-files/pres-social_networking_applications_on_mobile_devices.pdf

-9-Elcomsoft iOS Forensic Toolkit Guide:

http://www.champlain.edu/Documents/LCDI/Elcomsoft_iOS_Forensic_Toolkit_Guide.pdf

-10-Cellebrite iOS Device Physical Extraction Manual:

http://www.ume-update.com/UFED/iOS_User_Manual.pdf

-11-What Happens When You Press that Button?:

https://www.cellebrite.com/collateral/Explaining_Cellebrite_UFED_Data_Extraction_Processes.pdf

-12-Phone Forensics Express v2.1.2.2761 Test Results for Mobile Device Acquisition Tool:

https://www.dhs.gov/sites/default/files/publications/508_Test%20Report_NIST_Mobile_Phone%20Forensics%20Express%20v2.1.2.2761_December%202015.pdf

-13-Lantern v4.5.6 Test Results for Mobile Device Acquisition Tool:

https://www.dhs.gov/sites/default/files/publications/508_Test%20Report_NIST_Lantern%20v4.5.6_August%202015_Final_1.pdf

-14-Test Results for Mobile Device Acquisition Tool: Lantern v2.3, NIST:

https://ncjrs.gov/pdffiles1/nij/241154.pdf

-15-OS Forensics with Open-Source Tools:

http://2014.zeronights.org/assets/files/slides/belenko.pdf

-16-Elcomsoft iOS Forensic Toolkit, Physical Acquisition for 64-bit Devices and iOS 9 Support:

https://www.elcomsoft.com/PR/eift_151118_en.pdf

-17-Cellebrite Unlocking Services Now Available for Apple iOS 9:

http://www.cellebrite.com/Pages/cellebrite-unlocking-services-now-available-for-apple-ios-9-and-samsung-galaxy-s6-and-s7-devices

-18-Apple iOS and Watch OS Artifacts:

https://docs.google.com/spreadsheets/d/1zAqSSiLZ-Fw6RrXg7qegkxbE7ejXI_mpxQre_ybWRWw/

-19-P Box User Tutorial:

http://www.champlain.edu/Documents/LCDI/IP_BOX_User_Tutorial_Edited.docx

-20-IP Box Documentation:

http://www.teeltech.com/wp-content/uploads/2014/11/IP-Box-documentation-rev2-1-16-2015.pdf

-21-dentifying Back Doors, Attack Points, and Surveillance Mechanisms in iOS Devices:

http://www.sciencedirect.com/science/article/pii/S1742287614000036

-22-ios backdoors & attack points & surveillance mechanisms:

https://pentest.com/ios_backdoors_attack_points_surveillance_mechanisms.pdf

-23-Phone security model & vulnerabilities:

http://esec-lab.sogeti.com/dotclear/public/publications/10-hitbkl-iphone.pdf

-24-iPhone data protection in depth:

http://esec-lab.sogeti.com/static/publications/11-hitbamsterdam-iphonedataprotection.pdf

-25-Forensics iOS:

https://www.sstic.org/media/SSTIC2012/SSTIC-actes/forensicsios/SSTIC2012-Slides-forensicsios-sigwald_bedrune.pdf

-26-Overcoming data protection to re-enable iOS forensics:

https://media.blackhat.com/bh-us-11/Belenko/BH_US_11_Belenko_iOS_Forensics_Slides.pdf

-27-Handling iOS encryption in a forensic investigation:

http://www.delaat.net/rp/2010-2011/p26/report.pdf

-28-iOS Keychain Weakness FAQ:

http://sit.sit.fraunhofer.de/studies/en/sc-iphone-passwords-faq.pdf

-29-Lost iPhone? Lost Passwords:

https://www.sit.fraunhofer.de/fileadmin/dokumente/studien_und_technical_reports/Whitepaper_Lost_iPhone.pdf

-30-iOS Encryption Systems:

http://www.a-sit.at/pdfs/Technologiebeobachtung/ios-encryption-systems.pdf

-31-End User Devices Security Guidance:

https://www.gov.uk/government/publications/end-user-devices-security-guidance-apple-ios-9/end-user-devices-security-guidance-apple-ios-9

-32-CIS Apple iOS 9 Benchmark, Center for Internet Security:

https://benchmarks.cisecurity.org/downloads/show-single/?file=appleios9.100

-33-CIS Apple iOS 7 Benchmark, Center for Internet Security:

https://benchmarks.cisecurity.org/downloads/show-single/?file=appleios7.110

-34-iOS Hardening Configuration Guide:

http://www.asd.gov.au/publications/iOS5_Hardening_Guide.pdf

-35-Security Configuration Recommendations for Apple iOS 5 Devices:

https://cryptome.org/2012/06/apple-ios5-sec.pdf

-36-Information about MBDB and MBDX formats:

http://code.google.com/p/iphonebackupbrowser/wiki/MbdbMbdxFormat

-37-Phone 3GS Forensics: Logical analysis using Apple iTunes Backup Utility, Mona Bader, Ibrahim Baggili, Small Scale Digital Device Forensics Journal:

http://securitylearn.net/wp-content/uploads/iOS%20Resources/iPhone%203GS%20Forensics%20Logical%20analysis%20using%20Apple%20iTunes%20Backup%20Utility.pdf

-38-Forensic Analysis of iPhone backups:

http://www.exploit-db.com/wp-content/themes/exploit/docs/19767.pdf

-39-Information about Encrypted iTunes backups:

http://www.youtube.com/watch?v=mNLOokxME5A

-40-Information about iTunes backup analysis:

http://blog.crackpassword.com/2013/09/itunes_backup_analysis/

-41-Advanced Smartphone Forensics:

http://elcomsoft.com/presentations/nullcon2014.pdf

-42-Looking to iPhone backup files for evidence extraction:

http://ro.ecu.edu.au/cgi/viewcontent.cgi?article=1091&context=adf

-43-iPhone Backup Files. A penetration Tester's Treasure:

http://www.sans.org/reading-room/whitepapers/testing/iphone-backup-files-penetration-testers-treasure-33859

-44-Mac OS X: iOS device backup locations:

https://forensicartifacts.com/2015/10/mac-os-x-ios-device-backup-locations/

-45-Ubiquity Forensics: Your iCloud and You:

https://github.com/mac4n6/Presentations/blob/master/Ubiquity%20Forensics%20-%20Your%20iCloud%20and%20You/Ubiquity_Forensics-Your_iCloud_and_You.pdf

-46-iCloud Keychain and iOS 7 Data Protection:

https://speakerdeck.com/belenko/icloud-keychain-and-ios-7-data-protection

-47-Modern Smartphone Forensics:

http://conference.hitb.org/hitbsecconf2013kul/materials/D2T2%20-%20Vladimir%20Katalov%20-%20Cracking%20and%20Analyzing%20Apple's%20iCloud%20Protocol.pdf

-48-Apple iCloud Inside out:

https://deepsec.net/docs/Slides/2013/DeepSec_2013_Vladimir_Katalov_-_Cracking_And_Analyzing_Apple_iCloud_Protocols.pdf

-49-Cracking and Analyzing Apple iCloud backups:

https://www.elcomsoft.com/PR/recon_2013.pdf

-50-A Digital Forensic Analysis on the iCloud and its Synchronization to Apple® Devices:

http://www.marshall.edu/forensics/files/FRIEDMANRACHEL-Research-Paper-08242012.pdf

-51-Changes Examiners Face with iOS 8.3:

https://www.blackbagtech.com/blog/2015/05/06/changes-examiners-face-with-ios-8-3/

-52-iOS 8.3: the end of iOS Forensics?:

http://blog.digital-forensics.it/2015/06/ios-83-end-of-ios-forensics.html

-53-iOS 8 and its Impact on Investigations:

https://www.blackbagtech.com/blog/2014/09/24/ios-8-and-its-impact-on-investigations/

-54-The iOS of Sauron: How iOS Tracks Everything You Do:

https://github.com/mac4n6/Presentations/blob/master/iOS%20of%20Sauron%20-%20How%20iOS%20Tracks%20Everything%20You%20Do/iOS_of_Sauron_04162016.pdf

-55-Parsing iOS "Frequent Locations":

http://www.mac4n6.com/blog/2015/12/20/parsing-the-ios-frequent-locations

-56-Apple iOS: Recently Deleted images:

http://forensenellanebbia.blogspot.it/2015/10/apple-ios-recently-deleted-images.html

-57-Kik Messenger Forensics:

http://www.xploreforensics.com/blog/kik-messenger-forensics.html

-58-Times a' Ticking...to Forensicate the Apple Watch! presentation:

https://github.com/mac4n6/Presentations/blob/master/Apple%20Watch%20-%20Times%20a'%20Tickin'/Apple_Watch_Times_a_Tickin.pdf

-59-iOS Application Forensics:

http://www.scribd.com/doc/57611934/CEIC-2011-iOS-Application-Forensics

-60-Third Party Application Forensics on Apple Mobile Devices:

http://www.researchgate.net/publication/224221519_Third_Party_Application_Forensics_on_Apple_Mobile_Devices

-61-The Investigation iOS Phone Images, File Dumps & Backups:

http://www.magnetforensics.com/investigating-ios-phone-images-file-dumps-backups/

-62-The Analysis Of iOS Notes App:

http://articles.forensicfocus.com/2013/11/02/analysis-of-ios-notes-app/

-63-Forensic Artifacts of the ChatOn Instant Messaging application:

http://ieeexplore.ieee.org/xpl/articleDetails.jsp?reload=true&arnumber=6911538

-63-Forensic analysis of social networking applications on mobile devices:

https://github.com/mac4n6/Presentations/blob/master/Apple%20Watch%20-%20Times%20a'%20Tickin'/Apple_Watch_Times_a_Tickin.pdf

-64-The From iPhone to Access Point:

http://articles.forensicfocus.com/2013/09/03/from-iphone-to-access-point/

-65-Analysis of WeChat on iPhone:

http://www.atlantis-press.com/php/download_paper.php?id=10185

-66-Know Your Suspect - Uncovering Hidden Evidence from Mobile Devices with Oxygen Forensics:

http://www.forensicfocus.com/c/aid=74/webinars/2014/know-your-suspect---uncovering-hidden-evidence-from-mobile-devices-with-oxygen-forensics/

-67-Information about iPhone Call History Database:

-68-iPhone Call History:

http://cryptome.org/isp-spy/iphone-spy2.pdf

-69-The Who's Texting? The iOS6 sms.db:

http://linuxsleuthing.blogspot.com/2012/10/whos-texting-ios6-smsdb.html

-70-The Parsing the iPhone SMS Database article:

http://linuxsleuthing.blogspot.it/2011/02/parsing-iphone-sms-database.html

-71-The Addressing the iOS 6 Address Book and SQLite Pitfalls article:

http://linuxsleuthing.blogspot.it/2012/10/addressing-ios6-address-book-and-sqlite.html

-72-The iOS 6 Photo Streams: "Recover" Deleted Camera Roll Photos:

http://linuxsleuthing.blogspot.it/2013/05/ios6-photo-streams-recover-deleted.html

-73-The Recovering Data from Deleted SQLite Record:

http://linuxsleuthing.blogspot.it/2013/09/recovering-data-from-deleted-sqlite.html

-74-The SQLite Data Parser to Recover Deleted Records:

http://az4n6.blogspot.com/2013/11/python-parser-to-recover-deleted-sqlite.html

-75-orensic Acquisition and Analysis of Tango VoIP:

https://www.insight-centre.org/sites/default/files/publications/icciet-2014.pdf

-76-Challenges in Obtaining and Analyzing Information from Mobile Devices:

http://computerforensicsblog.champlain.edu/wp-content/uploads/2014/05/Challenges-in-Obtaining-and-Analyzing-Information-from-Mobile-Devices-DavydovO-5-20-2014.pdf

-77-The Advanced Smartphone Forensics poster:

https://digital-forensics.sans.org/media/DFIR-Smartphone-Forensics-Poster.pdf