Prepare an iOS device for image acquisition

Before you acquire an image from an iOS device, verify that your computer and device are set up correctly.

To allow AXIOM Process to connect to the iOS device and acquire the most complete forensic image possible, there are several options that you need to set. After setting these options, you should also perform an encrypted backup. AXIOM Process can often extract more evidence from an iOS device if it first creates an encrypted backup of the device. An encrypted backup can include information that isn't available in a normal quick image, such as saved passwords (iOS keychain), health data (HealthKit), smart home data (HomeKit), and more.

Tip: If you don't want your search criteria to be saved in the recent search history on the device, don't use the magnifying glass on the mobile device to search for settings or other information.

  • Verify your computer is running the latest version of iTunes.
  • Turn on the device.
  • Connect the device to the computer using a sync cable (not a charging cable).
  • Charge the device to at least 30%.
  • Unlock the device.
  • Turn on airplane mode.
  • Verify that the device is running iOS 5 or later.
  • Turn off screen lock or set it to the maximum amount of time.
  • Set the screen timeout or sleep mode to stay awake, or to the maximum amount of time.
  • Trust the computer that the device is connected to. When you connect the device to the computer, follow the device's on-screen instructions. On iOS 8 and later, to revoke trust, tap Settings > General > Reset > Reset Location & Privacy.

Acquire an encrypted iOS backup

During the acquisition setup, AXIOM Process automatically prompts you for an encryption password if you choose the Quick image option. After the search starts, AXIOM Process creates an encrypted backup of the device and then decrypts the backup using the password that you provide. After imaging completes, AXIOM Process removes the password from the device.

  1. In AXIOM Process, click Evidence sources > Mobile > iOS > Acquire evidence.
  2. Select the device, and then click Next.
  3. Select the Quick image type and click Next.
  4. In the Encrypted iTunes backups dialog, provide a password to use for encryption and click Okay.
  5. To continue setting up your case, click Next.