iOS Forensics

Walkthrough summary

iOS Forensics TryHackMe walkthrough with 13 answered prompts and lab methodology notes.

Sample prompts covered

• What would look more suspicious? an empty hard drive or a full hard drive?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the definition for an abstract view of a hard drive?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of a forensics tool that couldn't be used in a court of law, because data could be written to the device being analysed?
  Open the walkthrough page to inspect the full answer and command flow.
• You've found an iPhone with no passcode lock, what acquisition method would you use?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the name of the certificate that gets stored on a computer when it becomes trusted?
  Open the walkthrough page to inspect the full answer and command flow.