Glossary of Terms
Commonly used terms and definitions in mobile digital forensics.
Device/phone setting to turn off Wifi and cellular services (Bluetooth and GPS are not turned off–When you turn on Airplane Mode, it turns off all radios except for Bluetooth)
The condition in which the device has been unlocked at least once since it was last turned on
Objects that have forensic value such as messages, applications, files, timestamps, and event logs etc. which can be used in mobile forensic investigations
The condition in which the device rebooted or powered on and has not been unlocked since
Entering every conceivable passcode until the actual passcode is revealed
Mobile Device Management (MDM) is a technology that is used to manage device deployments in enterprises. It is commonly used in corporate or government deployments to manage assets.
An extraction that contains all data on the device
Health-related information, emails, and location history
Information about the phone’s backup state is shown in the device status: whether iTunes or iCloud, whether encrypted, and last date of backup
(Typically) unique mobile phone identifier
A feature that can instantly unlock locked devices regardless of whether or not brute force is supported
products that use Apple’s iPhone Operating System, including iPhones and iPads
A password manager that is built into every Mac, iPhone, and iPad that allows your account names, passwords, and credit card numbers can be safely and securely stored on the device
Passcode is known to examiner
Tools such as GrayKey that help investigators retrieve deleted information, analyze, and preserve evidence on mobile devices that may arise during an examination of criminal activity
A technology that is used to manage device deployments in enterprises
Whether the device is unlocked, AFU (unlocked since last reboot), or BFU (not unlocked since last reboot).
A unique identifier for Apple’s iOS devices
Passcode is unknown to an examiner