For the matters of this section and in the real world, iOS devices include the iPhone, iPad, and iPod touch. The Apple Watch runs Watch OS, which is similar to iOS. We do not cover Apple TV in this course, but some concepts apply. Although some may agree that iOS and Mac OS X are similar, the main differences are the gesture-based touch interface on the iOS device and some logging. The two operating systems also manage files in different manners. The internal components of iOS devices are broken down in detail in the book written by Heather Mahalik, Rohit Tamma, and Satish Bommisetty, Practical Mobile Forensics, Second Edition (Birmingham, UK: Packt, 2016).

File systems on iOS devices are similar to HFS+ and APFS, and the data is primarily stored in SQLite database and plists. APFS (Apple File System) fixed core problems and bugs from HFS. APFS is used on devices running iOS 10.3 and later. Regardless of the file system, iOS device applications sandbox their data, primarily for security purposes, which also makes our investigations easier because the data should be stored within a cached database file for each application. Data storage and application decoding are covered later in this section and in Section 5.

iOS devices differ from other smartphones and mobile devices in that they do not have a removable battery and do not have slots for external storage. Prior to the iPhone 4s, only GSM iPhones contained SIM cards. Verizon added a SIM card to the CDMA version of the iPhone 4s to give it "world phone" capabilities as discussed in Section 1. All iOS devices released after 2011 now contain SIM cards in various physical (micro-SIM and mini-SIM) to support LTE (Long Term Evolution) and digital forms as ESIM. A great reference for every Apple device is listed at https://for585.com/specs.

The data residing within the NAND Flash Memory consists of SQLite databases and plists. The SQLite database files are comprised of everything imaginable (contacts, locations, communications, preferences, and more). The plists are generally used by applications to store, organize, and access data on the iOS device. The plists are stored in XML or binary format and often contain embedded BLOBs that store items of interest. BLOBs are covered in detail in Sections 4 and 5 of this course.

Property List Files (plist) are structured text files containing information needed for the iOS device and applications to function. The format looks similar to an XML file and is not always easy to read unless you utilize a plist editor/viewer. The plist files should be examined for relevance to your investigation.

The iOS architecture of the iPhone is detailed in this slide. The User Space is comprised of the Core Services, which run at the lowest level of this partition. Core Services include the Address Book, SQLite databases, XML files, plists, and other core files. The next level is comprised of multimedia files, which run under the Cocoa Touch framework. The Cocoa Touch framework handles the iOS device user interface. The final layer consists of Apple and third-party applications. The Kernel or System Space is comprised of the hardware layer and the System Area.

This image was composed with information found on https://for585.com/bada.

Reference:

[1] https://for585.com/mahalik