Mobile Device
Forensics

Simulated Scenario

This study project was structured around a fictional case scenario provided as part of a digital forensics course exercise. The scenario: an iPhone belonging to a fictional suspect had been seized as potential evidence in a fraud and theft investigation. The device was provided in a classroom/study context with simulated case data pre-loaded to represent a realistic investigation.

CASE REF:   SIM-DFIR-2024-011   [STUDY PROJECT — SIMULATED DATA]
────────────────────────────────────────────────────────────────
DEVICE:     iPhone (model withheld per study guidelines)
            iOS version: 16.x
            Storage: 64 GB

SCENARIO:   Suspect alleged to have used the device to coordinate
            a fraudulent online purchase scheme and a physical
            theft. Case study asks analysts to recover evidence
            of communications, location presence, and financial
            transaction records from the device.

OBJECTIVE:  Perform forensic acquisition, extract and analyse
            relevant iOS artifacts, reconstruct a timeline of
            key events, and produce admissibility-ready
            documentation with hash verification.
────────────────────────────────────────────────────────────────
NOTE: All names, addresses, and identifying details in this
      project are entirely fictional and generated for the
      study exercise. No real personal data was used.

Forensic Methodology

The four-phase forensic process followed in this study project mirrors the methodology used in professional digital forensics: acquire an evidence image without altering the original, preserve integrity through cryptographic hashing, analyse artifacts systematically, and produce structured documentation.

• 1
  Acquisition — Image the Device
  Used iMazing to create a full encrypted iTunes-compatible backup of the iPhone. Recorded the backup location and timestamp. Immediately generated MD5 and SHA-256 hashes of the backup archive to establish a baseline for integrity verification throughout the investigation.
• 2
  Preservation — Hash Verification & Evidence Labelling
  Documented device details (IMEI, iOS version, storage capacity), acquisition tool version, examiner name, and timestamps on a chain-of-custody form. Stored the original backup in a read-only evidence container. All subsequent analysis was performed on a working copy, never on the original evidence.
• 3
  Analysis — Extract & Examine iOS Artifacts
  Imported the backup into Autopsy for structured artifact analysis. Extracted the SQLite databases underpinning SMS/iMessage (sms.db), Safari history (History.db), call logs (CallHistory.storedata), and location data. Used iMazing for human-readable views of messages and contacts. Parsed Photos EXIF data for geolocation coordinates.
• 4
  Reporting — Timeline & Documentation
  Correlated all extracted timestamps into a chronological event timeline. Produced a structured forensic report with: Executive Summary, Device Overview, Chain-of-Custody Log, Key Findings, Event Timeline, and Exhibit Index. Formatted to meet legal admissibility guidelines as practised in the study course.

Artifacts Recovered

The following iOS artifact categories were examined during the analysis phase. Each was sourced from a specific SQLite database or file within the iOS backup structure.

The iOS backup structure stores most user data in SQLite databases organised under a 40-character SHA-1 hash folder naming scheme. Key database paths within a decrypted backup:

# Key SQLite databases within a decrypted iOS backup (relative paths)

HomeDomain/Library/SMS/sms.db
    └── Tables: message, chat, attachment, handle

HomeDomain/Library/Safari/History.db
    └── Tables: history_items, history_visits

HomeDomain/Library/CallHistoryDB/CallHistory.storedata
    └── Tables: ZCALLRECORD

HomeDomain/Library/AddressBook/AddressBook.sqlitedb
    └── Tables: ABPerson, ABMultiValue

CameraRollDomain/Media/DCIM/
    └── .jpg/.heic files — EXIF GPS coordinates embedded

# Hash verification (performed on acquired backup archive)
examiner@forensics-ws:~$ md5sum iphone_backup_SIM-DFIR-2024-011.zip
a3f7d9e1b2c4f8a0e5d7c1b9f3e2d4a6  iphone_backup_SIM-DFIR-2024-011.zip
examiner@forensics-ws:~$ sha256sum iphone_backup_SIM-DFIR-2024-011.zip
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  iphone_backup_SIM-DFIR-2024-011.zip
[+] Hash recorded on chain-of-custody form at acquisition time. Verified again before analysis.

Chain of Custody

Chain-of-custody documentation ensures that evidence integrity can be demonstrated in legal proceedings. Even in a study scenario, practising this discipline builds the habit of treating digital evidence as legally sensitive from the moment of acquisition. The following table shows the custody log maintained throughout this study project.

Reconstructed Event Timeline

By correlating timestamps from multiple artifact sources, an activity timeline was reconstructed spanning the 72-hour period of interest in the study scenario. All times are in UTC. Entries marked with a highlight indicate key events relevant to the simulated case allegations.

Tools Used

Key Learning Outcomes

• ✓
  Practised the complete forensic acquisition-to-report workflow in a structured study environment — including hash verification at each stage, a discipline critical to maintaining evidence admissibility.
• ✓
  Learned the internal structure of iOS backups (SQLite database locations, plist files, hashed folder naming), enabling navigation of the backup without relying solely on GUI tools.
• ✓
  Recovered "deleted" content from SQLite databases by querying tables directly — understanding that iOS soft-deletion does not immediately overwrite database rows, and data persists until a VACUUM operation reclaims space.
• ✓
  Built a multi-source event timeline by correlating timestamps from four independent artifact types (messages, call logs, photos, browser history) — practising a core investigator skill for establishing chronological narratives.
• ✓
  Produced structured forensic documentation in a format consistent with legal admissibility requirements, including chain-of-custody logging, exhibit indexing, and hash manifests.