Has it been decided whether the Defendant will stay in your office until the examination is complete? Are you being provided with a minimum amount of time with the device?
I ask because I'm wondering if it's possible to inform the court that due to the methods by which you will be obtaining the data, it may become necessary to enter the passcode more than once. If the court is already assuming you'll need a few hours with the phone and the Defendant will be present at your office during that time, I don't think they'd have a problem ordering him to enter it two or three times instead of once. As long as the time frame is reasonable (so it doesn't appear you're wasting the Defendant's time) and it's addressed beforehand, I think this should be a fair middle ground.
I have talked with the prosecuting attorney, and she understands the court order to be a one-time unlock of the phone by the defendant. I have asked the first question you posed about the defendant remaining in my office for the duration of the download, and because I can't quantify how much time it will require, she says no. I have not been saddled with a time constraint, however.
I wish "fair" was admissible as an argument for a judge to rule on here, but the defense usually gets most of the breaks. (
Try and put a hidden camera in the area that the phone is going to be unlocked and make sure you thoroughly clean the screen before giving it to the defendant.
It the phone does lock a bit of fingerprint powder combined with the output from the camera will give you a good chance of working out the password.
Try and put a hidden camera in the area that the phone is going to be unlocked and make sure you thoroughly clean the screen before giving it to the defendant.
It the phone does lock a bit of fingerprint powder combined with the output from the camera will give you a good chance of working out the password.
Somehow I doubt that would go over well with any of the parties…
Try and put a hidden camera in the area that the phone is going to be unlocked and make sure you thoroughly clean the screen before giving it to the defendant.
It the phone does lock a bit of fingerprint powder combined with the output from the camera will give you a good chance of working out the password.
Best idea yet! lol
In all seriousness… take auto lock off straight away, complete your extraction on Cellebrite PA and if it were me, i'd dual tool this one to maximize the data obtained. No harm in using a 2nd tool!
…Still i do quite like ludlowboy's suggestion!! 8)
UFED PA can only do advanced logical on iPhone 4S so once the phone is unlocked you will not need to reboot it to do the download. As long as you disable autolock straight away you will be fine.
And as DCS1094 suggested run another tool across it as well while it's unlocked.
Oh and if it were me I'd put it straight in Airplane mode before anything else, just in case your bad guy has his iPad in the car out the front planning to log straight in to 'find my iphone' and initiate a remote wipe.
Once you do a single extraction with UFED PA, you will be able to do additional extractions on that same computer, even when the iPhone is locked again since pairing was already done in the first time.
Test this on a test iPhone.
RonS
Hi,
Just out of curiosity was there a computer with iTunes backups on also? And why such stringent rules, is this pretty standard in AZ or is this case specific? Obiously I am not asking you to divulge case specifics.
Steve
Try and put a hidden camera in the area that the phone is going to be unlocked and make sure you thoroughly clean the screen before giving it to the defendant.
It the phone does lock a bit of fingerprint powder combined with the output from the camera will give you a good chance of working out the password.
I'm sure no one will be suspicious when I tell them, "Okay, stand right here. No, over just a little bit. Now hold the phone at this angle. Okay, go ahead."
UFED PA can only do advanced logical on iPhone 4S so once the phone is unlocked you will not need to reboot it to do the download. As long as you disable autolock straight away you will be fine.
And as DCS1094 suggested run another tool across it as well while it's unlocked.
Oh and if it were me I'd put it straight in Airplane mode before anything else, just in case your bad guy has his iPad in the car out the front planning to log straight in to 'find my iphone' and initiate a remote wipe.
I have a trial of Device Seizure that I will fire up for my secondary tool. Airplane Mode does sound easier than my Faraday device. Thanks!
Hi,
Just out of curiosity was there a computer with iTunes backups on also? And why such stringent rules, is this pretty standard in AZ or is this case specific? Obiously I am not asking you to divulge case specifics.
Steve
No computer was recovered in this case.
The judge granted what the prosecutor requested – no more, no less. The request in the motion was to have the defendant unlock the iPhone, and that's what the judge granted. I don't think the prosecutor was tech-savvy enough to realize that, if something goes wrong, she'll have to go through this all over again to get the iPhone unlocked again. I will be speaking with my supervisor to have boilerplate language crafted regarding any future phone/computer password problems.