News
Evidence at risk: 5 iOS data that may disappear before you capture it
Time is money in any criminal investigation, but in the digital forensic world,the clock runs even faster. Some key data on iOS devices candisappear foreverif they are not removed in time.
In this entry, we tell you what are the5 sources of evidence on iOSWhat you should capture before they expire, why they are important, and how you can make sure you don't lose them.
Why does some mobile data expire?
Apple designed iOS with automatic processes to free up space on your device. Although this is useful for common users,complicates forensic work- Many relevant data are deleted after a short period if not extracted in time.
The consequence:loss of evidencewhich can be key to finding physical evidence or confirming behavioral patterns.
The 5 sources of evidence that can disappear
1. Cached locations — expire in 7 days
These reveal where the device was around the time of the crime. Extracting them in time allows the investigator to cross-reference this information with security cameras or testimonies.
2. KnowledgeC and BIOME data — expires in 28-30 days
They show how the user interacted with the device, even with apps that have already been removed. They are essential for analysis of life and behavior patterns.
3. Deleted photos — expire in 30 days
Photos in the trash can still contain valuable metadata (time, location, device). They can connect victims or suspects to the event under investigation.
4. Deleted iMessages — expire in 30 days
Conversations that may contain planning, confessions or connections with others involved. Note: the user may have set the automatic expiration to 30 or 365 days.
5. Safari History — expires in 30 days
Web searches offer clues about intent, preparation, or attempted cover-up. Provides context and reinforces timelines.
Good practices for processing mobile devices
Chad Gish, a Magnet Forensics consultant and former head of the Metro Nashville Police digital forensics lab, recommends:
"Process the devices as soon as possible, ideally in less than 5 days. And if not possible, preserve the data immediately."
How to preserve a mobile device?:
- Activeairplane modeand save it in aFaraday bag
- Turn offBluetooth, Wi-Fi and all radios
- Keep the deviceconnected to a constant power source
Improve your mobile extraction capabilities
Tools likeMagnet GraykeyandAxiomallow efficient and safe extraction. If you need to climb,Graykey Fastrakfacilitates fast and simultaneous extractions from multiple workstations.