![]() ![]() I only mention this so you are aware there could be additional differences that have not been discussed. ![]() Mainly, iOS 13 devices contained more data in /private/var/mobile/Containers/Data/PluginKitPlugin//tmp/ locations than iOS 12 devices. Important to note: While working on cases after this blog was initially written I noticed there were some difference between iOS 12 and iOS 13. I did notice when looking an iOS 12.*.* FFS extraction there were some differences. Was it because I haven’t been paying close enough attention during my exams?Įither way, I set out to test and validate what I discovered.Īpple iPhone 7 (A1778) Apple iPhone XS (A1920)ĭuring testing, I did not find any significant changes between 13.4.1 and 13.5.1 that would make the testing invalid. Was this because I was examining a full file system extraction? As a result of photos being captured, several files were created that I have not observed during my past examinations and I had a few questions. ![]() After the examination of an Apple iPhone 7, I discovered some photos were captured using the camera application () from within the native iPhone messaging application (). Synopsis: During an examination and analysis, I learned some interesting things and would like to share them with you. I came to the conclusion editing the original and reposting the entire blog was the best method to get you all of the information. I debated over rewriting it or just following up with an additional blog. It was my first research blog and after it was posted, I felt it was missing a few things. I must apologize if you have already taken the time to read through this blog. It’s an honor! Additionally, thanks to Jared Barnhart for his assistance with research and with testing. First, I would like to thank Heather Mahalik for her help with this process and for allowing me to post something on her blog. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |