An iPhone normally stores a lot of data in files that can be viewed or hidden files. For instance, when you exit the device’s built-in geo mapping application, the phone gets a screenshot and stores the same. The phone also has valuable information in regards to the user’s contacts, media preferences, whereabouts and habits. This means that performing forensics on the mobile device to view its files can be quite challenging. In fact, in the past, the process required a lot of effort and time. With the current generation of software, forensic analysis of an iPhone can be done very easily, quickly and by anyone as it does not require any technical expertise. For it to be done effectively, a certain process has to be followed.
Start by using iTunes to back up your iPhone’s files. To do this, you will need to connect the phone to a computer using a USB cable, and follow by launching the iTunes application. Right click or control clicks the iPhone icon that is located on the left side of the iTunes screen. Select back up and you will be prompted when the back-up process has completed.
The next step is navigating your computer to the iPhone Analyzer software website. You will have to download the software before you can use it. A small advertisement will appear after which you will be asked two questions. The first option would be to ‘open’ the file (which will automatically launch the application) or ‘save’ the software onto your hard disk. Select the option that you would prefer. For example, saving the software can allow you to run it on a different computer.
Once the application has been installed, use it to import the back-up files. At the top left corner of the program’s home screen, click ‘file’. The drop down menu will display a list of file options. Of these options, choose ‘default iTunes location’. This will cause the location of your backed up files from your iPhone to appear. The location of the file will look something similar to ‘iPhone 1.3: viaT Test iPhone v3.2.0 – Thu Jul 19 16:44:07 CDT 2011’. Select the backup that is most recent. The iPhone Analyzer will import all files form this backup.
Analyzing the iPhone data is the next step. The backed-up data will appear in the program’s main window once there has been completion of importing the phone’s data from iTunes. It will be divided into three main columns mainly:
- ‘Manifest’ – which is a list of all files stored in your device. The list includes hidden files.
- ‘Phone information’ – is in the centre and it outlines any relevant data that is specific about your phone (product, model, make, name and so forth)
- ‘Browse files’ – located on the far left screen, and is a directory of the content in your iPhone. It is arranged in the same way your files are stored (contacts, photos, shortcuts, messages etc)
View individual files the way they are shown on the screen or choose to view them in SQL database format. Click on the entry in the directory you wish to explore like contacts. Photos, shortcuts, messages etc. you now have the option of clicking on individual files that are related to the directory you have chosen. The file will now be open.