iPhone and iOS Forensics: Investigation, Analysis and Mobile Security for Apple iPhone, iPad and iOS Devices [Paperback]

Andrew Hoog and Katie Strzempka turn out a first class effort as they take the reader through the world of iOS forensics and security. This book is appropriate for digital forensics examiners and incident responders of any level. As an added bonus, the iOS data security coverage makes it a nice option for those who are trying to decide if iOS devices are the right fit for their organization from a security standpoint.

This book provides a comprehensive view of the iOS forensics world. It handles the topic of acquisition in the manner that readers of good digital forensics books would expect. The authors speak clearly and at length about the various options to acquire data using a variety of methods that result in the logical and physical acquisition of data. They also spend an entire chapter on the topic of iOS data security which would likely be of great interest to those who aren't necessarily in the incident response and forensics world, but are interested in learning more about the security ramifications of introducing these devices into their environment. This book not only describes a variety of important security issues such as application security, but also provides recommended methods to best secure these devices.

It was the analytical portion of the book that I found to be the most impressive. The authors put forth an exemplary effort explaining the structure of the operating system and select applications using open source tools. I appreciated that the authors decision to handle the analytical portion of the book using an open source approach rather than teaching it through the prism of the paid tools. At times, this book felt like the iOS version of Digital Forensics with Open Source Tools given all of the references to classic open source tools like scalpel and The Sleuth Kit. Those who don't have the money for the more expensive commercial tools will appreciate this approach as they will be able to immediately implement what they are learning without being hobbled by lack of a tool budget.

The authors don't ignore the commercial tools, however. Chapter 7 is devoted to testing a wide variety of commercial tools against a test data set from a 3G iPhone. This section of the book is well done and provides the reader with a solid overview of the various tools along with a decent amount of screen shots. Unfortunately, the image quality of some the screenshots for my Kindle edition of the book (which I tested on several different devices) was sometimes lacking which caused me to remove a star from the review of the book. For example, the results for the testing of Cellebrite UFED were very difficult to read.

Taken as a whole, I strongly recommend this book to anyone who is interested in iOS digital forensics, incident response, and general security issues. My recommendation for anyone who is interested in the subject matter is to start with this book first and then decide if they need to read any other books. This book feels as close to one stop shopping as you will find at the present time which should help take the edge off the high price of the book.

› Go to Amazon.com to see the review  4.0 out of 5 stars