<![CDATA[Background: The advancement of security systems in modern smartphones, particularly iOS devices, has introduced significant challenges to digital forensic investigations. At the same time, law enforcement agencies increasingly rely on digital evidence, making the completeness and reliability of acquisition methods critical factors in forensic examinations. Objective: This study aims to evaluate the differences in the completeness of digital artifacts obtained through logical acquisition and full file system (FFS) extraction methods on an iPhone 13 running the latest iOS version. Methods: An experimental methodology was employed by developing a ground-truth dataset based on user activity scenarios, including communications, media exchanges, and application usage. The acquisition results were subsequently analyzed to measure the recovery rate of digital artifacts, including deleted data and application-related artifacts. Results: The findings indicate that the FFS extraction method is capable of recovering a more comprehensive set of artifacts than logical acquisition, particularly data that cannot be accessed through conventional methods. However, this method involves greater complexity and depends on advanced forensic tools. Specifically, the FFS method recovered 64,057 files compared to 959 files obtained through Advanced Logical Extraction, representing a 6,580% increase in artifact volume. Notable differences were observed in web history (1,466 vs. 43 entries), images (13,140 vs. 367 files), and database artifacts (997 vs. 188 records). Conclusion: This research highlights the importance of selecting appropriate acquisition methods to support investigative processes and legal evidence examination, while also identifying a research gap in the forensic evaluation of devices running the latest versions of iOS.]]>
Copyrights © 2026
