iOS手机取证概述

Overview of iOS Mobile Forensics

随着智能手机的发展，手机取证在犯罪调查、情报收集中越发显得重要。iOS手机取证是一项规范和精细的工作，为更好地在iOS设备尤其是iPhone手机上提取有价值的信息或者证据，首先介绍了iOS设备的基本属性，如i0S操作系统、文件系统、数据存储方式、数据库系统，并结合实际取证过程分析了iOS设备的基本数据获取方式、数据获取技术、自带应用程序分析、第三方应用程序分析等，以帮助取证人员更好地开展iOS手机取证实践。

With the development of smart phones,mobile forensics is becoming increasingly important in criminal in- vestigation and intelligence collection, lOS mobile forensics is a normative and fine work in practice. In order to effec- tively extract valuable information or evidence from iOS devices, especially from iPhones, this paper introduced the basic properties of the iOS device, such as iOS operating system, lOS file system, data storage method, lOS database, and analyzed the basic data acquisition modes and techniques, preinstalled applications analysis, third-part application analysis, so as to help the forensics personnel to better carry out iOS mobile forensics in practice.