MOBILE FORENSICS

iPhone Backups – Options and Limitations

Backups are among the most important sources of data in iPhone forensics. They often make it possible to examine a wide range of user and application data without the original device being required on a permanent basis. At the same time, every backup has technical limitations that must be taken into account when evaluating the results.

Contacts and Calendar
Messages and call logs
Photos and metadata
App data
Safari artefacts
Notes
Device settings

TECHNICAL BACKGROUND

Technical Fundamentals

Depending on the configuration, there are different types of backup, in particular local Finder or iTunes backups, as well as iCloud backups.

Depending on the backup method, the following may be included, amongst other things:

  • •Contacts and Calendar
  • •Messages and call logs
  • •Photos and metadata
  • •App data
  • •Safari artefacts
  • •Notes
  • •Device settings

The exact scope depends on the settings selected, the encryption used and the time at which the backup was taken.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
First, the type of backup, as well as its completeness and integrity, are checked. The artefacts it contains are then analysed using recognised forensic tools and manual analysis. The results are always interpreted in the context of the relevant data set and documented in a transparent manner.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What data does a backup contain?
  • ✔What are the differences between local and iCloud backups?
  • ✔What information is typically missing?
  • ✔How reliable is a backup?
  • ✔Can a backup replace the original device?

LIMITATIONS & CONCLUSION

What you should know

A backup does not necessarily reflect the complete state of an iPhone. Certain data is generally not backed up, or is only available in encrypted backups or under specific conditions. Missing data should therefore not automatically be interpreted as missing events.

Backups form a valuable basis for many IT forensic investigations. However, their evidential value can only be properly assessed by taking into account the specific backup method used and its technical limitations.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have an iPhone backup professionally examined or its evidential value assessed? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Can a backup completely replace an iPhone?
No. Depending on the type of backup, certain data or device properties may be missing.
Are local and iCloud backups identical?
No. The content and scope may vary.
Are encrypted backups beneficial?
They may contain additional data, provided that it can be analysed.
Can a backup serve as evidence?
It can be an important source of evidence; however, its probative value depends on the individual case.
Can an expert report be drawn up on this?
Yes, the findings can be documented in a digital forensics report.