When iOS versions update, many things may change. Be it a new file being leveraged, or data being formatted in a different way, it complicates mobile forensics. It’s up to us to identify these changes, adapt our methods, and alert the vendors of the tools if they aren’t already parsing it. Think about this – if you found it, so did someone else. However, they may not know it’s parsing incorrectly. Please report these issues. Even if it’s to our Google group to make others aware.

Since data changes are a reality, you will see this in Lab 4.2 later in this section. You will be presented with iOS 15 data and a query that worked for iOS 13. The point – forcing you to modify what is available and make it work!