Start reading iPhone Forensics on the free Kindle Reading App or on your Kindle in under a minute. Don't have a Kindle? Get your Kindle here.
Engineering & Transportation

Deliver to your Kindle or other device

Enter a promotion code
or gift card

Try it free

Sample the beginning of this book for free

Deliver to your Kindle or other device

Sorry, this item is not available in
Image not available for
Image not available

iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets [Kindle Edition]

Jonathan Zdziarski
3.8 out of 5 stars  See all reviews (11 customer reviews)

Digital List Price: $31.99 What's this?
Print List Price: $39.99
Kindle Price: $17.27
You Save: $22.72 (57%)

Free Kindle Reading App Anybody can read Kindle books—even without a Kindle device—with the FREE Kindle app for smartphones, tablets and computers.

To get the free app, enter your email address or mobile phone number.


Amazon Price New from Used from
Kindle Edition $17.27  
Paperback $29.61  
Shop the New Digital Design Bookstore
Check out the Digital Design Bookstore, a new hub for photographers, art directors, illustrators, web developers, and other creative individuals to find highly rated and highly relevant career resources. Shop books on web development and graphic design, or check out blog posts by authors and thought-leaders in the design industry. Shop now

Book Description

"This book is a must for anyone attempting to examine the iPhone. The level of forensic detail is excellent. If only all guides to forensics were written with this clarity!"-Andrew Sheldon, Director of Evidence Talks, computer forensics experts

With iPhone use increasing in business networks, IT and security professionals face a serious challenge: these devices store an enormous amount of information. If your staff conducts business with an iPhone, you need to know how to recover, analyze, and securely destroy sensitive data. iPhone Forensics supplies the knowledge necessary to conduct complete and highly specialized forensic analysis of the iPhone, iPhone 3G, and iPod Touch. This book helps you:

  • Determine what type of data is stored on the device
  • Break v1.x and v2.x passcode-protected iPhones to gain access to the device
  • Build a custom recovery toolkit for the iPhone
  • Interrupt iPhone 3G's "secure wipe" process
  • Conduct data recovery of a v1.x and v2.x iPhone user disk partition, and preserve and recover the entire raw user disk partition
  • Recover deleted voicemail, images, email, and other personal data, using data carving techniques
  • Recover geotagged metadata from camera photos
  • Discover Google map lookups, typing cache, and other data stored on the live file system
  • Extract contact information from the iPhone's database
  • Use different recovery strategies based on case needs

And more. iPhone Forensics includes techniques used by more than 200 law enforcement agencies worldwide, and is a must-have for any corporate compliance and disaster recovery plan.

Editorial Reviews

About the Author

Jonathan Zdziarski is better known as the hacker "NerveGas" in the iPhone development community. His work in cracking the iPhone helped lead the effort to port the first open source applications, and his book, iPhone Open Application Development, taught developers how to write applications for the popular device long before Apple introduced its own SDK. Prior to the release of iPhone Forensics, Jonathan wrote and supported an iPhone forensics manual distributed exclusively to law enforcement. Jonathan frequently consults law enforcement agencies and assists forensic examiners in their investigations. He teaches an iPhone forensics workshop in his spare time to train forensic examiners and corporate security personnel.

Jonathan is also a full-time research scientist specializing in machine learning technology to combat online fraud and spam, an effort that led him to develop networking products capable of learning how to protect customers. He is founder of the DSPAM project, a high-profile, next-generation spam filter that was acquired in 2006 by Sensory Networks, Inc. He lectures widely on the topic of spam and is a foremost researcher in the fields of machine-learning and algorithmic theory.

Jonathan's website is

Product Details

  • File Size: 1194 KB
  • Print Length: 140 pages
  • Simultaneous Device Usage: Unlimited
  • Publisher: O'Reilly Media; 1 edition (December 17, 2008)
  • Sold by: Amazon Digital Services, Inc.
  • Language: English
  • ASIN: B0026OR3BW
  • Text-to-Speech: Enabled
  • X-Ray:
  • Word Wise: Not Enabled
  • Lending: Not Enabled
  • Amazon Best Sellers Rank: #963,028 Paid in Kindle Store (See Top 100 Paid in Kindle Store)
  •  Would you like to give feedback on images?

Customer Reviews

3.8 out of 5 stars
3.8 out of 5 stars
Share your thoughts with other customers
Most Helpful Customer Reviews
21 of 25 people found the following review helpful
3.0 out of 5 stars Well-written and informative, but over-priced September 27, 2008
Format:Paperback|Verified Purchase
I wish the author had just put the info on a free website. The book is just a document, a pamphlet as another reviewer mentioned. I feel a bit ripped-off. In fact, in one place the author actually says "before proceeding, ensure that the firmware ... falls within the range of versions supported by this document." He is referring to the book but calling it a document. I think he intended it to be just a document and O'Reilly convinced him to make it a book so O'Reilly could make some money.

As far as technical material, it's all good and well-written. There are a few cases where it appears the O'Reilly editor might have cluelessly changed a sentence, but those cases are rare compared to some professionally-edited books. There are some typos, even in the author's bio! But few compared to many books. The index was rushed, I'm guessing. It didn't include the items I wanted to find.

The only other caveat I can think of is that if you are considering forensically analyzing your iPhone just for fun, be prepared for quite a bit of work and possible headaches. With firmware 2.x, there are numerous, reasonably complex steps that must be followed. You will need lots of time and patience and little aversion to risk. Note that you are jail-breaking your phone so that you can install utilities in the system partition, which voids the warranty from what I understand. Also, you could brick your iPhone, though in theory you could restore it if there are problems.

All in all, great info for forensics examiners in law-enforcement and corporations. I give it three stars instead of five because of the high price for a pamphlet.
Was this review helpful to you?
9 of 11 people found the following review helpful
2.0 out of 5 stars Outdated, author unhelpful. Stay away! February 15, 2010
Format:Paperback|Verified Purchase
This book is definitly not for you in active forensics. The methods described are outdated, the book only covers up til iphone OS 2.x, nothing you will find in a realworld scenario 2009/2010.
Upon contacting the author for an updated method, which oreilly boasts about on their website aswell as the author, the author wants you to pay him $5000 annually. Keep away from this charlatan, do some online research instead, you will learn more, starting with dev-teams redsnow and othe FREE utils, you can modify those utils to do the work, forensically sound.

I am very disapointed. Shame on you Zdziarsky. Shame on you O'reilly books.
Was this review helpful to you?
24 of 32 people found the following review helpful
1.0 out of 5 stars Overpriced and thin September 24, 2008
I normally don't leave reviews but my copy showed up today and I wanted to warn folks. This book is less then 100 pages. Looking closer at the listing it does say 138 but it is 120 with the index. Till you drop out the fluff you're left with little more then a pamphlet. Honestly I never even looked at page count when I pre-ordered as it was an O'Reilly book. It is very thin. Information is okay (still working through it) but to charge [...] for a book this small is ludicrous. I've never been this disappointed in an O'Reilly title - some have been so-so but never a down-right ripoff. My copy will be returning.
Comment | 
Was this review helpful to you?
3 of 3 people found the following review helpful
4.0 out of 5 stars Great introduction to iPhone forensics August 2, 2010
This is an invaluable resource to understanding forensic details in regards to the iPhone. While it is small in size (coming in at just over 100 pages), it is dense in detail. This book provides good detail about where data on the iPhone is located, how to recover it, and how to keep your forensic footprint small.

For readers not as versed in computer forensics, the book does a good job introducing the subject. The iPhone is disceted in detail, and much information is provided regarding how to access the details of the phone that Apple doesn't want you to get at. Once you get at that information, the book shows how to extract that data onto a non-iPhone device. This is a great read for anyone who may have to deal with recovering data off an iPhone due to terminiation or other law enforcement issues.

My only complaint about the book is that this first edition was printed in September 2008, so it's missing some information about current versions of the iPhone firmware and hardware for the iPhone 3GS iPhone 4. Aside from that single issue, this is an excellent resource, and certainly a great resource for hardware up to the iPhone 3 and firmware versions up to 2.x.
Comment | 
Was this review helpful to you?
3.0 out of 5 stars Look for a different book? September 23, 2012
Format:Paperback|Verified Purchase
It's now been 4 years since this book has come out. So how useful is it now? Not very. On the plus side, it provides an overview of the kinds of information that can be extracted from a live iPhone. On the downside, the specifics given are for the earliest versions of the iPhone and are unlikely to work properly with any iPhone created after 2008.

Also missing, even for older versions, is what to do with a dead iPhone. The author alludes to the need for special equipment, but doesn't say what equipment, or how you would use it. Hook up a JTAG probe? Remove the flash and read it on another device? He doesn't say.

If you go to the author's website, you find he offers a class for law enforcement with updated and more comprehensive info. Good for him, but that doesn't help anyone who buys this book.

So, essentially, the book is for someone who would like to learn the basics of how to do digital forensics, but it's not going to help you recover emails from your Uncle Bill's iPhone 4 after he dropped it in the toilet.
Comment | 
Was this review helpful to you?
Most Recent Customer Reviews
Search Customer Reviews
Search these reviews only

More About the Author

Discover books, learn about writers, read author blogs, and more.

What Other Items Do Customers Buy After Viewing This Item?


There are no discussions about this product yet.
Be the first to discuss this product with the community.
Start a new discussion
First post:
Prompts for sign-in

Look for Similar Items by Category