Since logical acquisition is the most common option for modern iOS devices, we'll demonstrate how to use a few more free tools. The first one is the Belkasoft Acquisition Tool. This tool can be used not only for iOS device acquisition, but also for hard drives, and even cloud data.
Let's acquire an iPhone running iOS 13.2.3 using the Belkasoft Acquisition Tool:
- Launch the Belkasoft Acquisition Tool and choose the Mobile device option:
Choosing the source
- In the next window, choose the Apple option:
Choosing the mobile type
- Now, choose the acquisition method and the image path:
Choosing the acquisition method
The tool is able to create an iTunes backup if the device isn't jailbroken and perform filesystem extraction if it is.
- Wait for the task to finish successfully. You will find your device's logical image in the folder you chose in the previous step:
Creating the backup
The backup can be analyzed both by Belkasoft Evidence Center and by many other mobile forensic tools.