Given the vast amount of loose knowledge now out there in the community, and the increasing number of commercial tools available to conduct both law enforcement and private sector acquisition of an iOS device, I’ve decided to make my law enforcement guide, “iOS Forensic Investigative Methods” freely available to all. The manual contains a lot of useful low-level information about the iPhone and the different artifacts commonly found while performing a forensic analysis. Chapter 3 requires a set of tools to actually image the device (which are not presently available to the public), however there are a number of commercial and open source tools that can be substituted here to acquire a disk image. Anyone with a little experience should be able to figure out by now how to get a copy of their own device’s disk. There is plenty of knowledge in this manual to teach you the basics of where to find information, such as various caches and other data, on the device, and what kind of evidence to look for when conducting investigations. It may also give the informal geek a peek down the rabbit hole to see just what kind of data is stored by your device. I decided to release this for the betterment of technical knowledge in the community, so enjoy!