CHFI (312-49) Digital Forensics Simulation
Investigation Scenario
You are a digital forensics examiner assisting with an internal fraud investigation in San Jose, California. A corporate iPhone issued to the primary suspect has been seized. Legal counsel has authorized a full logical acquisition of the device before it is placed in the secure evidence locker.
You have connected the device to a designated forensic workstation (macOS Ventura). The lab standard operating procedure (SOP) strictly mandates that maximum possible user data must be extracted, specifically including saved web credentials, Wi-Fi passwords, and health application data, as these are critical to establishing the suspect's movements and access logs.
Evidence Parameters
- Device: Apple iPhone 14 Pro (Corporate Asset)
- State: Powered on, AFU (After First Unlock), passcode known.
- Workstation: MacBook Pro (Forensic Lab Machine 04)
- Connection: Physical via Lightning-to-USB cable
- Target Artifacts:
Keychain.plist, Safari Credentials, HealthKit databases.
Question 20
After initiating an internal fraud investigation in San Jose, California, examiners must obtain a forensically useful iPhone backup via Finder on a Mac. The lab requires that the backup be password-protected so it preserves credentials and other protected items for analysis. What action must be selected in the Finder workflow to meet this requirement?
Expert Analysis
1. What evidence shows
The scenario indicates a need for a "forensically useful" backup that preserves credentials (Keychain data) and protected items. The methodology specified is a logical acquisition using Apple Finder on a macOS host.
2. Identify forensic stage
Collection / Preservation. The examiner is actively acquiring data from the seized device to create a forensic image (in this case, a logical backup) for subsequent analysis.
3. Why correct answer is correct
D. Select Encrypt local backup is correct. In iOS logical acquisitions, an unencrypted backup intentionally omits sensitive data such as Keychain passwords, Health data, HomeKit configurations, and certain application states to protect user privacy if the host computer is compromised. By selecting "Encrypt local backup" and setting a known password (which the examiner documents in their notes), iOS is forced to include these sensitive, encrypted artifacts in the backup payload. Forensic tools (like Cellebrite PA or Magnet AXIOM) later use this known password to decrypt and parse the Keychain during the analysis phase.
4. Why others are wrong
A. Selecting the destination ("to this Mac") dictates where the backup goes, but does not alter the contents (manifest) of the backup to include protected items.
B. "Trust This Computer" is a necessary prerequisite step (pairing) to allow data exchange over the USB port, but it does not initiate the backup nor specify the inclusion of Keychain data.
C. Clicking "Back Up Now" executes the backup process, but if the "Encrypt local backup" flag is not explicitly checked beforehand, the resulting backup will be standard and devoid of the required protected credentials.
5. Real-world forensic action
When performing logical extractions of iOS devices, examiners almost universally configure an encrypted backup using a standard lab password (e.g., "1234"). This password is meticulously recorded in the Chain of Custody or examiner notes. Once the backup completes, the raw folder (typically located in ~/Library/Application Support/MobileSync/Backup/) is hashed, preserved, and ingested into an analytical tool along with the documented password.
MINI LESSON: iOS Logical Acquisition Constraints
- Artifact Interpretation: The phrase "Encrypted Backup" is counter-intuitive in forensics. Usually, encryption hinders investigation. Here, triggering Apple's backup encryption is the mechanism required to dump the highly valuable
Keychain.plist. - Evidence Handling: Never use a personal or easily guessable password related to the suspect. Use a documented lab-standard password to ensure any future examiner reviewing the evidence can access the encrypted manifest.
- Forensic Workflow: The typical flow is: Isolate network -> Disable auto-lock (if possible) -> Connect to forensic host -> Trust pairing -> Set Encryption Flag & Password -> Initiate Backup -> Hash acquired directory.