Flash-based devices have always been vulnerable for all things forensics – as flash chips are time-consuming to delete, most operating systems do not invest the time and power needed for a thorough delete. This allows data to be recovered…and is what Jonathan’s book is all about!
![]()
Jonathan starts out by looking at the legal implications of forensic research, and also at the iPhone’s hardware. Especially the latter section is well-written and is ideal for people whe haven”t got too much iPhone experience (coverage: up to 3G iPhone, iPod 2G is excluded).
The next parts of the book look at custom firmware and desktop forensics. While the firmware creation process could be explained better and requires a Mac to some extent, I nevertheless had no major issues getting it up and running. Some of the information revealed is shocking: for example, did you know that the iPhone saves a png file showing the last state of each and every application?
iPhone forensics ends with a few source code listings and further legal advice…
As usual for all things O’Reilly, the book is well-written and has decent paper quality. Screenshots, figures and tables are provided in ample amounts to make grasping the content easier. Windows users can follow most of the steps outlined with no or minimal extra effort – there is no need to keep a Mac around…
![]()
In the end, iPhone forensics is an excellent book which will leave you wanting to bury your iPhone (or, to a lesser extent, your iPod touch) under a rock. Jonathan Zdziarsky has done an excellent job – if you are interested in the topic of forensics, the slightly-steep 26$ are well-spent!


