NOW READ THIS
("Security Advisory")

Go Back

---

Submitted by: Bill Hickey
NCVA Listmaster

NRT-0608 iPhone temporary screenshots may be recoverable:

A digital forensics expert recently reported that Apple's iPhone handset captures screenshots of a user's most recent actions and stores them to cache, according to an online press report. The expert indicated that this is done for "aesthetic purposes" when a user taps the 'Home' button. The expert speculated that the phone probably deletes each image after proceeding to a new action, although he warned that because deletion does not always permanently remove files from storage, these screenshots can be recoverable. He claimed that forensics experts have recovered these screenshots during criminal investigations.

The expert also noted this is not the only way to collect evidence during a forensics investigation, stating that evidence also can be obtained from places like the iPhone's keyboard cache or the Safari browser's cache. Experts also can recover deleted photos or e‑mails from the device.

[Wired.com 11Sep08]

Last Modified: Thursday, 09-Oct-2008 07:30:24 EDT