iPhone Forensics: Recovering Evidence, Personal Data, and Corporate Assets (Paperback)

by Jonathan Zdziarski (Author)
Key Phrases: electronic discovery, activation records, toolkit payload, Google Maps, Installing the Recovery Toolkit, Apple Computer (more...)

Editorial Reviews

Product Description
"This book is a must for anyone attempting to examine the iPhone. The level of forensic detail is excellent. If only all guides to forensics were written with this clarity!" -Andrew Sheldon, Director of Evidence Talks, computer forensics experts With iPhone use increasing in business networks, IT and security professionals face a serious challenge: these devices store an enormous amount of information. If your staff conducts business with an iPhone, you need to know how to recover, analyze, and securely destroy sensitive data. iPhone Forensics supplies the knowledge necessary to conduct complete and highly specialized forensic analysis of the iPhone, iPhone 3G, and iPod Touch. This book helps you:

Determine what type of data is stored on the device Break v1.x and v2.x passcode-protected iPhones to gain access to the device Build a custom recovery toolkit for the iPhone Interrupt iPhone 3G's "secure wipe" process Conduct data recovery of a v1.x and v2.x iPhone user disk partition, and preserve and recover the entire raw user disk partition Recover deleted voicemail, images, email, and other personal data, using data carving techniques Recover geotagged metadata from camera photos Discover Google map lookups, typing cache, and other data stored on the live file system Extract contact information from the iPhone's database Use different recovery strategies based on case needs

And more. iPhone Forensics includes techniques used by more than 200 law enforcement agencies worldwide, and is a must-have for any corporate compliance and disaster recovery plan.

About the Author
Jonathan Zdziarski is better known as the hacker "NerveGas" in the iPhone development community. He is well known for his work in cracking the iPhone and lead the effort to port the first open source applications. Hailed on many geek news sites for his accomplishments, Jonathan is best known for the first application to illustrate and take full advantage of the major iPhone APIs: NES.app, a portable Nintendo Entertainment System emulator.

Jonathan is also a full-time research scientist and longtime spam-fighter. He is founder of the DSPAM project, a high profile, next-generation spam filter that was acquired in 2006 by a company designing software accelerators. He lectures widely on the topic of spam and is a foremost researcher in the fields of machine-learning and algorithmic theory.

Jonathan's website is zdziarski.com.

Product Details

• Paperback: 138 pages
• Publisher: O'Reilly Media, Inc.; 1 edition (September 17, 2008)
• Language: English
• ISBN-10: 0596153589
• ISBN-13: 978-0596153588
• Product Dimensions: 8.8 x 6 x 0.4 inches
• Shipping Weight: 7.2 ounces (View shipping rates and policies)
• Average Customer Review: 4.0 out of 5 stars See all reviews (6 customer reviews)
• Amazon.com Sales Rank: #156,524 in Books (See Bestsellers in Books)

  Popular in these categories: (What's this?)

  #10 in	Books > Computers & Internet > Programming > APIs & Operating Environments > Palm OS
  #16 in	Books > Computers & Internet > Security & Encryption > Forensics
  #49 in	Books > Computers & Internet > Networking > Telephony

Customer Reviews

Most Helpful Customer Reviews

9 of 12 people found the following review helpful:

3.0 out of 5 stars Well-written and informative, but over-priced, September 27, 2008

By	Priscilla Oppenheimer (Ashland, OR USA) - See all my reviews

I wish the author had just put the info on a free website. The book is just a document, a pamphlet as another reviewer mentioned. I feel a bit ripped-off. In fact, in one place the author actually says "before proceeding, ensure that the firmware ... falls within the range of versions supported by this document." He is referring to the book but calling it a document. I think he intended it to be just a document and O'Reilly convinced him to make it a book so O'Reilly could make some money.

As far as technical material, it's all good and well-written. There are a few cases where it appears the O'Reilly editor might have cluelessly changed a sentence, but those cases are rare compared to some professionally-edited books. There are some typos, even in the author's bio! But few compared to many books. The index was rushed, I'm guessing. It didn't include the items I wanted to find.

The only other caveat I can think of is that if you are considering forensically analyzing your iPhone just for fun, be prepared for quite a bit of work and possible headaches. With firmware 2.x, there are numerous, reasonably complex steps that must be followed. You will need lots of time and patience and little aversion to risk. Note that you are jail-breaking your phone so that you can install utilities in the system partition, which voids the warranty from what I understand. Also, you could brick your iPhone, though in theory you could restore it if there are problems.

All in all, great info for forensics examiners in law-enforcement and corporations. I give it three stars instead of five because of the high price for a pamphlet.

11 of 15 people found the following review helpful:

1.0 out of 5 stars Overpriced and thin, September 24, 2008

By	Tim Crothers "Avid Security Reader" (Grand Rapids, MI) - See all my reviews (REAL NAME)

I normally don't leave reviews but my copy showed up today and I wanted to warn folks. This book is less then 100 pages. Looking closer at the listing it does say 138 but it is 120 with the index. Till you drop out the fluff you're left with little more then a pamphlet. Honestly I never even looked at page count when I pre-ordered as it was an O'Reilly book. It is very thin. Information is okay (still working through it) but to charge [...] for a book this small is ludicrous. I've never been this disappointed in an O'Reilly title - some have been so-so but never a down-right ripoff. My copy will be returning.

2 of 2 people found the following review helpful:

5.0 out of 5 stars Excellent process for acquiring DD dump of iPhone, May 27, 2009

By	Robert Elder - See all my reviews

This book is an excellent documentation of the processes required to bypass the passcode of a locked iPhone and for hashing and creating a DD image of the two data partitions found on the iPhone. Works for both 1.X and 2.X iphones. I also recommend taking the course, well worth the money and provides an excellent hands on for the processes found in the book. Jonathan is a wealth of knowledge and an excellent instructor.