Elcomsoft iOS Forensic Toolkit Guide - Computer and Digital Forensics
Elcomsoft iOS Forensic Toolkit Guide - Computer and Digital Forensics
Elcomsoft iOS Forensic Toolkit Guide - Computer and Digital Forensics
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Patrick Leahy Center for <strong>Digital</strong> Investigation (LCDI)Figure 11 - Acquiring User Partition with Manual ModeFigure 12 - User Partition Transfer Times5Acquiring Logical PartitionBoth modes of the <strong>Elcomsoft</strong> <strong>iOS</strong> <strong>Forensic</strong> <strong>Toolkit</strong> can acquire a logical partition of supported <strong>iOS</strong> devices as a tarball, atype of Linux archive file (see Figure 13).During logical acquisition, only actual files, [meaning files that aren’t deleted,] are copied to thecomputer (retaining the directory structure). The process is generally significantly faster than physicalacquisition, as the data residing in unallocated areas of the partition does not have to be transferred.Page 12 of 20
Change language