How to Load a Forensic iPhone Image, Whatever Produced It

iPhone evidence reaches an examiner in a handful of shapes. A full-filesystem extraction arrives from an acquisition platform: an extracted Cellebrite UFED tree with its .ufd, .ufdx and DeviceInfo.txt descriptors or a VeraKey (Grayshift, now Magnet Forensics) capture. A logical backup arrives as a MobileBackup2 folder, whether Sherlock acquired it from an unlocked device or iTunes or Finder made it months before anyone knew there would be a case. Sherlock loads all three through the same open-the-source workflow, with automatic detection deciding the parser path.

There is no proprietary case container to import into and no conversion utility between the evidence and the analysis. That matters beyond convenience: every format conversion is a step someone can be cross-examined about. Loading the source directly, read-only, keeps the distance between what was acquired and what was analyzed as short as it can be.

1. Stage the evidence locally. Work from a copy on the analysis workstation and keep the original media intact. If the extraction arrived archived, unpack it to a local folder so the filesystem tree and its descriptors are browsable. Avoid cloud-synced folders; local disk keeps custody clean and analysis fast.
2. Open the source in Sherlock. Point the tool at the tree or backup folder. Detection is automatic: UFED descriptors, the VeraKey layout or the MobileBackup2 folder layout each route to the right parser path. An encrypted backup prompts for its password and decrypts offline via RFC 3394 keybag unwrap and AES.
3. Verify identity and provenance. Confirm the device model, iOS build and identifiers Sherlock reads from the source itself. For extractions, review the provenance record carried verbatim from the acquisition descriptors: acquisition tool and version, examiner machine, capture times and the per-dump SHA-256 and HMAC values recorded at capture, ready to compare against the files as received.
4. Analyze. Work the evidence across 130+ dedicated views. Run global and keyword-watchlist search, read the automated findings, walk the merged timeline and flag items as you go; flagged items roll into the report.
5. Report and export. Produce the court-ready HTML report with case and evidence numbers, examiner details, disclosed methodology and an optional SHA-256 evidence-integrity manifest. Print to PDF or export any view to CSV or JSON.

All 130+ views are available against any loaded source, but what populates them depends on what the source contains. Sherlock states that honestly rather than papering over it. A full-filesystem extraction populates the deep behavioral groups: pattern of life from Screen Time and power-log records, significant locations with dwell times and enter and exit transitions, app install and launch history, chat recovered from web caches and delivered-notification previews for apps whose message stores are not directly readable. A logical backup populates the surface layer thoroughly, messages, WhatsApp, call history, Safari, photos with capture GPS and the keychain when the backup is encrypted, while the full-filesystem-only views show honest empty states instead of fabricated data.

That empty state is a feature, not a gap. An examiner who testifies about what the tool showed also testifies about what it did not show. A view that reads empty because the source cannot contain that artifact is a defensible statement. A tool that quietly fills gaps is not.

The tree is not fully unpacked. The most common failed load is pointing the tool at an archive or a half-extracted folder. Unpack the whole extraction first and open the top of the resulting tree, the level where the descriptors sit, not a subfolder inside it.

The evidence sits in a cloud-synced folder. OneDrive, Dropbox and their peers touch files while you work, which is exactly the interaction an examiner does not want on evidence and a frequent source of slow or failing reads. Stage the working copy on plain local disk.

You were given the report, not the extraction. A PDF or a viewer export from the producing party is not the evidence; it is a summary of it. If the matter justifies real analysis, request the extraction itself, the tree with its descriptors, then load that.

The backup is encrypted and nobody has the password. An encrypted backup needs its backup password to open; Sherlock decrypts offline once it has it but does not crack passwords. Establish who set the password before the review is scheduled, not after.

The production is partial. If the provenance record's per-dump hashes do not match the files as received or entire directories are missing against the descriptor, document it and raise it with the producing party before drawing conclusions from what remains.

Loading never writes to the evidence: analysis is 100 percent read-only from detection through report. For extractions, the acquisition tool's own record travels with the case, descriptors carried verbatim, per-dump hashes visible, so the integrity chain that started at capture stays unbroken through analysis. The court-ready report then adds the analysis-side documentation: examiner identification, methodology, an optional SHA-256 evidence-integrity manifest and the provenance record, the documentation elements described in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics.

Sherlock is built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible digital forensics practice. The workflow above is the one its own examiners use.

This page is about loading evidence that exists. Sherlock does not create full-filesystem extractions; producing one requires Cellebrite or GrayKey class acquisition tooling. Sherlock's own acquisition of a device in hand uses Apple's supported logical path and requires the passcode and the Trust prompt; it does not bypass locks on any iPhone. Confirmed extraction formats are Cellebrite UFED and VeraKey, each validated against real device images. A different source? Contact us before purchasing and we will confirm whether the layout is readable.

Download the free edition, open the tree or backup in front of you and see the workflow end to end. Unlock the full seat when the matter calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Read a Cellebrite UFED extraction · Read a VeraKey extraction · iPhone full-filesystem analysis