iOS Forensics

Prompts and answers

• What would look more suspicious? an empty hard drive or a full hard drive?
  an empty hard drive
• What is the definition for an abstract view of a hard drive?
  Image
• What is the name of a forensics tool that couldn't be used in a court of law, because data could be written to the device being analysed?
  iFunbox
• You've found an iPhone with no passcode lock, what acquisition method would you use?
  Direct Acquisition
• What is the name of the certificate that gets stored on a computer when it becomes trusted?
  Trust Certificate
• Who was the recepient of the SMS message sent on 23rd of August 2020?
  Lewis Randall
• What did the SMS message say?
  Did you get the goods?
• Looking at the address book, what is the first name of the other person in the contacts?
  Jenny
• Following on from Question #3, what is their listed "Organization"
  Transportation
• Investigate their browsing history, what is the address of the website that they have bookmarked?
  https://blog.cmnatic.co.uk
• The suspected received an email, what is the remote_id of the sender?
  51.32.56.12
• What is the name of the company on one of the images stored on the suspects phone?
  TryHackMe
• What is the value of the cookie that was left behind?
  THM{COOKIES!!!}