Forums
Main Category
General (Technical,...
Apple Lockdown File
 
Notifications
Clear all

Apple Lockdown File

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by wotsits 10 years ago
7 Posts
5 Users
0 Reactions
1,207 Views
RSS
 wotsits
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter 29/01/2016 5:13 am  

I'm trying to learn more about using the Lockdown file to access locked iPhones.

When is the lockdown file created and updated? Is it immediately when the phone is plugged into the computer and the user selects to trust the computer or is it only when actually synced with iTunes?

It's also well known that when the phone has been switched off since the file updated that it can only extract media files.

But what about when the lockdown file is more than 30 days old? What limitations does that bring?


   
Quote
 mobileforensicswales
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
29/01/2016 6:23 pm  

Best place to get some comprehensive reading

http//www.zdziarski.com/blog/?s=lockdown&submit=Search


   
ReplyQuote
Igor_Michailov
 Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
29/01/2016 6:43 pm  

Best place to get some comprehensive reading

Extracting data from a passcode-locked iOS device

http//www.weare4n6.com/extracting-data-from-a-passcode-locked-ios-device/


   
ReplyQuote
OxygenForensics
 OxygenForensics
(@oxygenforensics)
Estimable Member
Joined: 14 years ago
Posts: 143
29/01/2016 9:30 pm  

We also have a short manual how to use a lockdown file in Oxygen Forensic products http//www.oxygen-forensic.com/download/articles/How%20to%20bypass%20iOS%20lockscreen%20protection.pdf


   
ReplyQuote
 hommy0
(@hommy0)
Trusted Member
Joined: 15 years ago
Posts: 98
29/01/2016 10:01 pm  

There is an enscript on Guidance Software's App Central that allows for extraction of the lockdown plist from an evidence file (be that from a PC or Mac). The enscript will then place this into the lockdown folder on your forensic workstation.

GSI App Central - Lockdown plist


   
ReplyQuote
 mobileforensicswales
(@mobileforensicswales)
Reputable Member
Joined: 17 years ago
Posts: 274
29/01/2016 10:05 pm  

I think it is quite important to note that these guides were only accurate at the time they were written. Lockdown files are certainly in no way the golden bullet they used to be. In the latest versions of iOS some are only valid whilst the phone is plugged in and unlocked for that session


   
ReplyQuote
 wotsits
(@wotsits)
Reputable Member
Joined: 10 years ago
Posts: 253
Topic starter 30/01/2016 9:58 pm  

We also have a short manual how to use a lockdown file in Oxygen Forensic products http//www.oxygen-forensic.com/download/articles/How%20to%20bypass%20iOS%20lockscreen%20protection.pdf

How long ago was this guide written?

What are the implications with iOS7 if the device has been powered off since the lockdown file created?


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Share: