Course Curriculum
-
01
INTRODUCTION
-
Introduction
-
About iOS
-
iOS History
-
iOS and iPad Adoption
-
iOS Recovery Options
-
We Don't Have the Privileges
-
-
02
FILE SYSTEMS
-
File System
-
File Systems For Manual Discovery
-
File Types - Video
-
File Types
-
Backups
-
iOS 4-iOS 9 Backup Structure
-
iOS 10+ Backup Structure - Video
-
iOS 10+ Backup Structure
-
Domain, IDs, and Paths
-
Data In File Column
-
iOS Introduces iTunes Prompt
-
iCloud Backups - Video
-
iCloud Backup
-
Exercise #1
-
Knowledge Check
-
-
03
ENCRYPTION
-
Encryption
-
Backup Encryption
-
Pairing
-
iOS 11 More Pin – Less Biometrics
-
iOS 13
-
iCloud Backups
-
-
04
ACQUISITION
-
Acquisition
-
USB Restricted Mode
-
Passcode, TouchID and FaceID
-
Recovering Data From Locked Devices
-
Introduction To HEIC and HEVC
-
Timestamps
-
iMessages In The Cloud
-
UDID
-
File System Images
-
-
05
ARTIFACTS
-
Artifacts
-
Application Artifacts
-
Browser Artifacts - Video
-
Browser (Safari) Artifacts
-
Location (Maps) Artifacts
-
iOS Media - Video
-
Media (Photos) Artifacts
-
Mail Artifacts
-
Communication (SMS/MMS/iMessage) Artifacts
-
-
06
SYSTEM ARTIFACTS
-
iOS System Artifacts - Installed Apps - Video
-
System Artifacts
-
iOS System Artifacts - Sysdiagnose and App Logs - Video
-
SysDiagnose and Application Logs
-
Application Artifacts (Extended)
-
iOS System Artifacts - PowerLog - Video
-
PowerLog.PLSQL (and archived copies)
-
iOS System Artifacts -KnowledgeC - Video
-
KnowledgeC
-
iOS System Artifacts - Network Usage - Video
-
Network Usage - Connection Data
-
iOS System Artifacts - Screentime - Video
-
ScreenTime
-
iOS Files Application
-
iOS Snapshots (*.KTX Files)
-
System Artifacts - Biome - Video
-
Biome Artifacts
-
Forensic Tools
-
Postface
-
Exercise #2
-
Knowledge Check
-
-
07
REFERENCES
-
References
-
Learning Outcomes
After completing this course, you will learn the following:
-
Gain understanding of the iOS file structure
-
Gain knowledge on what to look for during iOS analysis
-
Gain understanding of iOS security/encryption implementation
Technical Requirements
-
In this course you would need to have a basic understanding of mobile analysis, including timestamps and basic file system knowledge.
What is next at Cyber 5W?
Add your email to the mailing list to get the latest updates