iDevice forensics - Data integrity

There are different types of embedded portable iDevices which can be used in criminal activities. The most commonly used gadget in the field of embedded portable iDevices is the iPad. Techniques used to acquire data from iPad include jail breaking, using inbuilt operating system utilities and using forensic tools (open source, freeware or commercial). Data integrity is a vital element of digital forensics which must be ensured for acceptability of findings (retrieved forensic artifacts) in a court of law. In order to establish data integrity in iDevice forensics, investigations were performed using different techniques, specifically an operating system inbuilt utility, a freeware tool and a commercial tool. The forensic artifacts acquired from these tools and techniques were then compared to ascertain their data integrity. The results have shown that on one hand the freeware tools, under certain circumstance, also preserve data integrity as their commercial counterparts but on the other hand the commercial tools, under certain circumstance, also make data integrity doubtful as generally believed for freeware tools. Based on the results, the research has also recommended various data acquisition tools that the forensic examiner can select depending on the requirement.