Course Curriculum

  • 01

    INTRODUCTION

    • Introduction

    • About iOS

    • iOS History

    • iOS and iPad Adoption

    • iOS Recovery Options

    • We Don't Have the Privileges
  • 02

    FILE SYSTEMS

    • File System

    • File Systems For Manual Discovery

    • File Types - Video

    • File Types

    • Backups

    • iOS 4-iOS 9 Backup Structure

    • iOS 10+ Backup Structure - Video

    • iOS 10+ Backup Structure

    • Domain, IDs, and Paths

    • Data In File Column

    • iOS Introduces iTunes Prompt

    • iCloud Backups - Video

    • iCloud Backup

    • Exercise #1

    • Knowledge Check

  • 03

    ENCRYPTION

    • Encryption

    • Backup Encryption

    • Pairing

    • iOS 11 More Pin – Less Biometrics

    • iOS 13

    • iCloud Backups
  • 04

    ACQUISITION

    • Acquisition

    • USB Restricted Mode

    • Passcode, TouchID and FaceID

    • Recovering Data From Locked Devices

    • Introduction To HEIC and HEVC

    • Timestamps

    • iMessages In The Cloud

    • UDID

    • File System Images
  • 05

    ARTIFACTS

    • Artifacts

    • Application Artifacts

    • Browser Artifacts - Video

    • Browser (Safari) Artifacts

    • Location (Maps) Artifacts

    • iOS Media - Video

    • Media (Photos) Artifacts

    • Mail Artifacts

    • Communication (SMS/MMS/iMessage) Artifacts
  • 06

    SYSTEM ARTIFACTS

    • iOS System Artifacts - Installed Apps - Video

    • System Artifacts

    • iOS System Artifacts - Sysdiagnose and App Logs - Video

    • SysDiagnose and Application Logs

    • Application Artifacts (Extended)

    • iOS System Artifacts - PowerLog - Video

    • PowerLog.PLSQL (and archived copies)

    • iOS System Artifacts -KnowledgeC - Video

    • KnowledgeC

    • iOS System Artifacts - Network Usage - Video

    • Network Usage - Connection Data

    • iOS System Artifacts - Screentime - Video

    • ScreenTime

    • iOS Files Application

    • iOS Snapshots (*.KTX Files)

    • System Artifacts - Biome - Video

    • Biome Artifacts

    • Forensic Tools

    • Postface

    • Exercise #2

    • Knowledge Check
  • 07

    REFERENCES

    • References

Learning Outcomes

After completing this course, you will learn the following:

  • Gain understanding of the iOS file structure

  • Gain knowledge on what to look for during iOS analysis

  • Gain understanding of iOS security/encryption implementation

Technical Requirements

  • In this course you would need to have a basic understanding of mobile analysis, including timestamps and basic file system knowledge.

What is next at Cyber 5W?

Add your email to the mailing list to get the latest updates