DR. EASTTOM'S LEARNING LABS
LOCAL WORKSPACESTUDENT EDITION 1.1
Authorized iOS acquisition & artifact analysis

iPhone Forensics Studio

Connect an authorized iPhone through the local helper, analyze a backup, and turn traceable observations into a report.

Browser interface. Local evidence.

No accounts, analytics, or cloud processing.
01Acquire a backup
02Examine artifacts
03Document findings
BROWSER MODETraining, metadata inspection, and JSON report review are available. Start the local launcher for USB and database analysis.
Choose the right evidence workflow

A real analysis workspace, with explicit boundaries.

NO PASSCODE BYPASS
01

Connect an iPhone

Run the local Python launcher. Scan USB devices, authorize trust, create a logical backup, and analyze it.

02

Use an existing backup

Inspect metadata in this HTML alone. Use the local core or a separately configured external parser engine to parse databases.

03

Practice without a phone

Explore a fictional case generated from real SQLite-format test files. Follow six labs and export your observations.

Acquisition and analysis are separate steps. The optional local utility creates logical backups and runs the independent core parser; a separately configured external parser can extend coverage. A logical backup is not a full-filesystem image.
Optional desktop companion

Install the local utility

Install it on your Windows, Mac, or Linux computer. Nothing is installed on the iPhone.

INCLUDED WITH THIS PAGE
01

Browser only

Training case, six labs, exported case review, reports, and limited backup metadata. No installation needed.

02

Analyze local backups

Install Python and use the included local launcher. The core parses five limited artifact categories in unencrypted backups.

No extra Python packages
03

Connect a real iPhone

Complete local setup, then add the optional USB dependency and host device services. Use an authorized, unlocked device.

Additional USB setup
The local utility is Start_iPhone_Studio.py plus its companion files. It is already included in the download below; it is not an App Store application or a separate paid product. Python is installed separately.
Get Python from python.org

The ZIP is built from the companion files embedded in this page. No external download host, account, or network connection is needed for the kit itself. Downloading does not install or run anything.

1. Download and choose an installation folder

Use a writable local folder on the same computer to which you will connect the phone.

Click Download local utility (complete ZIP). Extract the whole ZIP, then place the resulting iPhone_Forensics_Studio folder in your local Documents folder. On Windows use Extract All; on macOS open the ZIP in Finder; on Linux use your archive manager. Do not run files from the ZIP preview.

Suggested location

Windows: C:\Users\YOUR_NAME\Documents\iPhone_Forensics_Studio
macOS: /Users/YOUR_NAME/Documents/iPhone_Forensics_Studio
Linux: /home/YOUR_NAME/Documents/iPhone_Forensics_Studio

These are examples. Choose a private, non-synchronized folder for real evidence. Do not use a public web-server directory or a shared cloud folder.

Check the extracted folder

You should see Start_iPhone_Studio.py, forensic_core.py, Run_External_Parser.py, iPhone_Forensics_Studio.html, Check_Setup.py, and the synthetic_backup folder together.

Only have an HTML file? Use the download button above. Do not download a lone Python launcher without its companions.

Choose your computer

2. Install Python and start the local core

Use a stable Python 3.11 or newer with SQLite support. The commands below use the suggested Documents location; change the first line to your actual extracted folder. Run each line separately, in order, and stop if a line fails.

Expected result

A browser opens a new address beginning with http://127.0.0.1: and a port number. The page should show LOCAL HELPER CONNECTED. Use that new page for USB access and actual database analysis. Keep the terminal window open; Ctrl+C stops the utility.

After setup, Start_Windows.cmd, Start_macOS.command, or Start_Linux.sh is a convenience launcher. The explicit terminal commands above are the reliable fallback if your operating system blocks double-click execution. Do not weaken your organization's security policies.

3. Add USB support only when you need a real phone

Skip this step for the training case or an existing unencrypted backup. First close the running helper with Ctrl+C. Complete the platform prerequisites below, then run the USB commands in the same extracted folder. Package installation needs internet access; analysis itself is local.

Install the device package into the same Python environment that runs the launcher. The commands use that environment directly; no activation script or execution-policy change is needed. Do not disable backup encryption to make the core parser work.

USB package and platform prerequisites: official device-library installation guide. Pairing/trust: Apple's Trust This Computer guidance. Record tested dependency versions before class; hardware combinations have not been validated here.

4. Verify the installation before collecting data

Test without a phone first

  1. In the locally opened page, confirm LOCAL HELPER CONNECTED.
  2. Open Backup & engines. Leave the independent core selected.
  3. Click Use included synthetic backup path, then Analyze backup.
  4. Expect 24 fictional records: 9 messages, 3 contacts, 5 Safari visits, 4 calls, and 3 app identifiers. The timeline contains 18 dated events.
  5. Export a report. The missing-payload warning in the training fixture is intentional.

Then verify USB separately

  1. Connect a class-owned iPhone using a data-capable cable.
  2. Open Connect iPhone and confirm examination authorization.
  3. Unlock the phone, scan, select its identifier, and read device information.
  4. Approve Apple's trust prompt on the phone when requested. A successful scan is not a completed acquisition.
  5. Use the acquisition button only when authorized; review status, completeness, and encryption limitations before interpreting results.

Browser-only page: start the local launcher to enable native operations.

Where files are stored, and how to stop

The launcher uses a case_output folder beside its Python file unless you supply --output. Acquisitions, reports, process logs, and case JSON persist there. Browser downloads go to your browser's download location. Keep enough free space for a backup, analysis copies, and reports.

Stop with Ctrl+C in the terminal. This utility does not install a background service. To remove it, stop it and remove the extracted application folder and its .venv after preserving any case output you are required to retain. Separately installed Python and host device software are not uninstalled. Clearing a browser case does not delete saved files.

Common installation problems

Python is missing or the command is not recognized
Install a stable desktop Python from the official download page and reopen your terminal. On Windows verify py -3 --version; on macOS/Linux verify python3 --version. The result must be 3.11 or later. On a managed computer, ask the administrator for an approved installation rather than bypassing restrictions.
The launcher says a file or module is missing
Extract the full kit. Confirm that the terminal is in the folder containing Start_iPhone_Studio.py, not its parent or the ZIP preview. Keep companion files together. Run Check_Setup.py using the virtual-environment interpreter shown above.
USB package installed, but the page still says it is missing
Stop the helper and run the USB commands for the selected operating system. Restart using the same .venv interpreter. A package installed with some other pip command may belong to another Python installation.
The website still shows BROWSER MODE
The hosted website and a double-clicked HTML file remain browser-only. Use the new loopback page opened by the Python launcher. The website intentionally does not access a local USB service. If no browser opens, copy the complete local address printed by the terminal into your browser. Do not invent a port number or expose it through a public tunnel.
Virtual environment creation fails on Linux
Install your distribution's Python venv package and confirm Python is 3.11 or later. On Debian/Ubuntu this is commonly python3-venv. If multiple Python versions are installed, use the matching version's venv package. Ask your administrator where package installation is restricted.
The computer does not list the phone
Check the data cable, USB port, host device services, device unlock/trust state, and organizational restrictions. Verify the platform notes in the official device-library guide. Installation checks verify software presence, not a working USB connection. Review process logs instead of assuming driver compatibility.
Advanced: optional instructor-configured external parser

This is separate from the included local utility and is not needed for the core or the training labs. An instructor can provide a trusted Python parser and its official installation documentation. This adapter is not a universal plugin system: it expects -t itunes -i INPUT -o OUTPUT, TSV report files, and --itunes_password for known-password encrypted analysis. Verify compatibility before use.

Start the Studio with --parser /full/path/to/trusted_entry_point.py; use --parser-python /full/path/to/python when that parser has a separate environment. No third-party source, dependencies, or licenses are repackaged or renamed. Original external logs, file paths, attributions, and native reports are preserved; their text is outside this interface's branding.

The independent core does not decrypt encrypted backups. Passwords for a compatible external parser are entered only in the launcher terminal, not the web page. Never disable encryption or reset a password merely to work around a parsing limitation.

Real device workflow

Connect an authorized iPhone

LOCAL HELPER REQUIRED
Need the local utility? Download it here, install it on this computer, and follow the Windows, macOS, or Linux steps.

The phone connects to your computer, not to this website's host. These controls only work in the page opened by Start_iPhone_Studio.py.

01 / PREPARE

Use a class-owned device

Install the prerequisites in Setup. Connect a data-capable USB cable. Close competing backup jobs.

02 / AUTHORIZE

Unlock and trust

Unlock the phone yourself and respond to the Trust This Computer prompt. Record this state change.

03 / PRESERVE

Acquire, then analyze

Use a new output folder. Keep the original acquired backup and review completeness before interpretation.

Fresh MobileBackup2 logical backup. The tool preserves the device's current backup-encryption setting.
There is no restore, erase, jailbreak, or encryption-disable command in this interface. Encrypted backups require a known backup password for parsing. The phone's passcode and the backup password are different credentials.

Acquisition limits that matter

Backup availability depends on the iOS version, device policy, trust state, and software compatibility. Cloud-only content, all third-party app data, deleted data, and a complete filesystem cannot be promised. Use a consenting, prepared classroom device rather than collecting students' unrelated private data.

For a supported Apple backup workflow, use Finder on macOS or Apple Devices on Windows, then analyze a working copy in the Backup tab. Do not turn off encryption merely to make the core parser work.

Analyze an existing backup

Select the device folder that contains Manifest.db, Info.plist, Manifest.plist, and Status.plist.

LOCAL FILESYSTEM ONLY
Need the local utility? Download it here, install it on this computer, and follow the Windows, macOS, or Linux steps.

Paste the folder path, not an iCloud backup, ZIP archive, drive root, or the phone's photo folder. Expand archives outside this tool first.

Shown when the local helper is running.
Core artifact categories
The core copies supported databases and available WAL/SHM sidecars before opening them. No original database is opened by SQLite. Core limits: 512 MiB per source database, 100,000 manifest entries, and 10,000 rows per category. Long text and oversized results are explicitly limited.
Encrypted backup? Select the configured external parser engine. When prompted, enter the known backup password in the launcher terminal, not this page. This integration requires a compatible external parser version that supports --itunes_password.

HTML-only backup metadata inspection

No launcher is needed for this limited option. Choose a backup folder to read its XML/binary plists, view the selected-file inventory, and hash its metadata files locally. This does not parse Manifest.db or message/contact/browser databases, and does not decrypt backup contents.

The browser may call its folder chooser an "upload." This page does not send the chosen files to a server; metadata inspection happens in memory on this computer.

Engine availability

Standalone HTML
Training, metadata inspection, and exported JSON case review.

Artifact explorer

Search returned records, inspect raw fields, and bookmark observations. Evidence URLs remain inert text.

NO CASE LOADED
Exports include filtered rows across pages.

CSV formula-like cells are prefixed with an apostrophe for spreadsheet safety. Use JSON for unchanged text. "Record ID" means source row ID for the core and TSV data-row position for external parser previews.

Correlate a timeline

Only records with a normalized, parseable UTC timestamp are shown. Raw timestamp values and conversion assumptions remain in Details.

UTC

A temporal relationship does not establish causation or actor identity. Core message timestamps use a disclosed seconds/nanoseconds magnitude heuristic. External-parser TSV text is not automatically assigned a timezone; use its native timeline output where available.
Before connecting a real phone

Setup, privacy, and tool boundaries

Six guided student labs

Scenario, purpose, rationale, numbered steps, and review questions. Completion is self-reported and session-only.

Fictional case: a training phone records an authorized transfer of classroom equipment. Your task is to reconstruct the sequence without treating an unusual record as proof of wrongdoing.
0 of 6 marked complete

Check your understanding

Official references

Troubleshooting

Document a defensible observation

Separate what the source says from what you infer. Notes remain in this browser session until exported.

NOT SAVED AUTOMATICALLY
The report always labels synthetic data, identifies the engine, and includes category statuses, source hashes, assumptions, and limitations. Bookmarks are observations you selected, not automatically validated findings. Review the report before sharing; device identifiers and personal content may be sensitive.

Open the exported HTML report and use your browser's Print / Save as PDF. Case JSON includes all loaded records, inventory, notes, and bookmarks; it does not contain the original database files. Native external-parser reports are generated only when that engine is actually used.

Report summary

Load a case first.

Record details & source context