killchain-compendium/Forensics/iOS.md

iOS Devices

Trust Certificates

• Exchanged between 'Trusted' devices and the charging iOS device.
• iTunes access to the iOS device has elevated permissions using the cert.
• Keychain may be extracted through iTunes.

Interesting Files

• ResetCounter.plist, hard Reset diagnostic counter
• com.apple.preferences.datetime.plist
• DB tables
  • Atendee
  • Task
  • Event
• Mail
• Safari
• Cookies
• Pictures
• Addressbook
• SMS
• Voicemail
• WiFi Keys

Backups

Encrypted and unencrypted backups can be chosen in the iTunes menu.

Tools

• iFunbox
• O.MG cable