An overview of some free and open source tools to perform forensic tasks on iOS devices.

1. FREE FORENSIC TOOLS
 Libimobiledevice
 iLEAPP
 iOS Triage
 iPhone Backup Decoder and Analyzer
 iOS sysdiagnose forensic scripts
 M.E.A.T. - Mobile Evidence Acquisition Toolkit

2. LIBIMOBILEDEVICE
 Cross-platform C library and set of CLI utilities to interact with
various native iOS service APIs and features, like apps, backup,
filesystem, debugging and so on.
 https://libimobiledevice.org/
https://github.com/libimobiledevice

3. ILEAPP
 iOS Logs, Events, And Plists Parser : a Python 3 script that is
able to parse an iOS full file system directory, directly from a
tar file, for several artifacts like:
- Mobile Installation Logs;
- iOS notifications;
- Build info (iOS version, etc.);
- Wireless cellular service info…
 https://github.com/abrignoni/iLEAPP

4. IOS TRIAGE
 iOS Triage is Bash script to extract various artifacts from an iOS
device.
 The device must be “jailbroken” using checkra1n
(https://checkra.in/).
 It depends on libimobiledevice.
 https://github.com/RealityNet/ios_triage

5. IPHONE BACKUP DECODER AND
ANALYZER
 Tool that allows to browse the contents of an iOS backup, parse
the backup directory and show the decoded filesystem tree
 https://github.com/iOSForensics/iPhone-Backup-Analyzer-2

6. IOS_SYSDIAGNOSE_
FORENSIC_SCRIPTS
 A collection of Python scripts to analyze iOS sysdiagnose logs
and extract various info and configuration data.
https://github.com/cheeky4n6monkey/iOS_sysdiagnose_forensic
_scripts

7. M.E.A.T.
 Mobile Evidence Acquisition Toolkit: a toolkit written in Python
to perform logical and filesystem acquisitions of iOS devices.
 Device must be jailbroken to perform filesystem acquisition.
 https://github.com/jfarley248/MEAT