iPod Forensics: Forensically Sound Examination of an Apple iPod

This paper reports on the development of a method for extracting and verifying an image of the hard drive of an iPod in a forensically sound manner via a USB2 connection, so as to create a standard operating procedure for Australian Law Enforcement. It also establishes an understanding of the nature of proprietary data stored on the iPod and indicates how this can be used as a guide within a forensic investigation. It also develops a sound understanding of the nature of any metadata stored on the iPod and reports on how the information gained, and the standard operating procedures developed from this research, may be applied to gain a better understanding of imaging issues in other portable electronic devices, such as music players and memory based devices, and how similar standard operating procedures may be constructed for the analysis of these devices