Chapter 11 — Further Reading

Foundations (🔬 / deeper)

• Apple Platform Security Guide (Apple, current edition). The authoritative primary source for the Data-Protection key hierarchy, the Secure Enclave and UID, Effaceable Storage, keybags, and the protection classes described in this chapter. If you read one thing, read the "Encryption and Data Protection" sections — everything in the iPhone half of this chapter traces back here.
• Android Open Source Project — "Encryption" and "Storage" documentation (source.android.com). The counterpart for FBE (fscrypt), FDE (dm-crypt), Device- vs Credential-Encrypted storage, metadata encryption, adoptable storage, and the role of the TEE/StrongBox and Weaver. Precise on which behavior arrived in which Android release.
• Sergei Skorobogatov, "The bumpy road towards iPhone 5c NAND mirroring" (2016). The research behind the chapter's war story — exactly why mirroring beat a SEP-less phone and why it cannot touch a Secure Enclave device. A short, vivid lesson in where the secret physically lives.

Approachable explanations (everyone)

• EFF — Surveillance Self-Defense, "Key Concepts in Encryption" and the phone-security guides (ssd.eff.org). Plain-language framing of why device encryption protects users — the same mechanism that walls you out is the one protecting them. Useful vocabulary for client conversations.
• Apple Support — "Digital Legacy"; Google — "Inactive Account Manager." The sanctioned routes to a deceased person's account. Bookmark both; you will steer grieving families toward them more often than you will run any tool.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• libimobiledevice (libimobiledevice.org). Open-source idevicebackup2, ideviceinfo, idevicepair — back up and query iPhones from the command line, including the broken-screen-via-pairing-record workflow. 💾
• iMazing / Dr.Fone / PhoneRescue. Commercial GUIs that present backup contents (messages, photos, contacts) without scripting; reach for these first on routine jobs, and fall back to Manifest.db scripting when they choke on partial backups. 💾
• Genymobile scrcpy (github.com/Genymobile/scrcpy). Mirror and control an Android phone over adb — the broken-screen lifesaver from the chapter's war story. 💾 🛡️
• photorec / testdisk by Christophe Grenier (cgsecurity.org). The workhorse carvers for portable SD cards; pair with the JPEG/HEIC signatures in Appendix A. 💾 🔍
• android-backup-extractor / abe.jar (github.com/nelenkov/android-backup-extractor). Unpacks legacy adb backup .ab archives (24-byte header + zlib tar) where they still work. 💾 🔍

Reference (this book)

• Appendix A — File Signatures Reference: the JPEG/HEIC/ftyp magic numbers you carve cards with.
• Appendix D — Forensic Artifact Locations: the iTunes/Finder backup paths and Manifest.db/Info.plist structure, plus pairing-record locations.
• Appendix H — Command-Line Reference: dd/dcfldd, photorec, adb, hashdeep, and friends.
• Appendix J — Practice Images and Lab Setup: where to get safe images for the carving labs.
• Chapter 9 — SSD and Flash Recovery: the flash-and-NAND background this chapter assumes.
• Chapter 24 — Mobile Device Forensics: the forensic sibling — locked devices, warrant-authorized extraction, Cellebrite/GrayKey, and their real limits.
• Chapter 29 — Encrypted Device Forensics: the full encryption treatment the key-hierarchy section previews.

Do, don't just read

• Carve your own card. Do the chapter's Try This: copy a dozen JPEGs to a spare microSD, delete and quick-format it, image it with dd, then run photorec and a manual SOI/EOI carve. Count intact vs. truncated files and the duplicate thumbnails from .thumbnails/. One afternoon teaches more about flash recovery than a chapter of reading — and it is safe, because it is your own card.
• Parse a backup by hand. Find an iTunes/Finder backup on your own machine, open Manifest.db in a SQLite browser, and prove for yourself that SHA1("HomeDomain-Library/SMS/sms.db") equals 3d0d7e5fb2ce288813306e4d4636395e047a3d28 and that the file sits in the 3d/ subfolder. Now you can explain it to a judge.
• Rehearse the honest "no." Write and say aloud the plain-language paragraph from Exercise 11.24 — the one you give a client whose locked, backup-less modern phone cannot be recovered. The technical wall is easy; delivering it kindly takes practice.

Next: Chapter 12 — Ransomware Recovery: from a single locked phone to a whole locked business — shadow copies, stale backups, and the pay/don't-pay decision, proving once more that the cheapest recovery is the backup you made before you needed it.