Title: Apple devices acquisition and forensic analysis

Authors: Parag Shukla; Aditya Pratap

Addresses: School of Computing, Kaushalya – The Skill University, Gujarat, India ' Salesforce, Hyderabad, Telangana, India

Abstract: Apple devices have become challenging to conduct forensic investigations primarily due to security mechanisms and the architecture used by Apple. Also, there has been limited exposure to the investigators as compared to the acquisition and analysis of Android and Windows devices. As part of this research paper, we will provide a brief description of iOS and MAC internals including the internal filesystem, how the data is stored by applications, different boot modes and about the new security features implemented by Apple to encrypt the data stored within eMMC. In addition, we look into different acquisition and analysis methods which are available for Apple devices that can be performed via open-source and commercial tools.

Keywords: apple devices; acquisition; jailbreak; iOS; Mac; forensic investigation.

DOI: 10.1504/IJESDF.2026.156137

International Journal of Electronic Security and Digital Forensics, 2026 Vol.18 No.5, pp.558 - 575

Received: 10 Jul 2024
Accepted: 31 Oct 2024
Published online: 07 Sep 2026 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article