iPhone and IP Box experts please

Also, since most every new iPhone is for now at least impenetrable what's your procedure when you get handed a new iPhone? Is it just simply check if there's a passcode or if it's jailbroken, find if you have a lockdown file and if not send instructions to ask the suspect for the passcode?

This is exactly what the procedure is, yes. Also bear in mind that if the device has been switched off, you must enter a passcode the first time you switch it on.

I can see this making mobile examiners obsolete in the future.

Bear in mind that most defendants will willingly provide their passcode, in my experience. And the same goes for any device-wide encryption (TrueCrypt FDE on PCs, for example).

All covered in great detail in this paper

http//www.teeltech.com/wp-content/uploads/2014/11/IP-Box-documentation-rev2-1-16-2015.pdf

Also, since most every new iPhone is for now at least impenetrable what's your procedure when you get handed a new iPhone? Is it just simply check if there's a passcode or if it's jailbroken, find if you have a lockdown file and if not send instructions to ask the suspect for the passcode?

This is exactly what the procedure is, yes. Also bear in mind that if the device has been switched off, you must enter a passcode the first time you switch it on.

Well I would assume most every phone that an examiner gets is powered off due to having run flat, unless a case was so urgent it got handed in under a day?

I can see this making mobile examiners obsolete in the future.

Bear in mind that most defendants will willingly provide their passcode, in my experience. And the same goes for any device-wide encryption (TrueCrypt FDE on PCs, for example).

What's your experience of this? My experience is most defence solicitors advise their client not to give out passwords and the like in interview.

All covered in great detail in this paper

http//www.teeltech.com/wp-content/uploads/2014/11/IP-Box-documentation-rev2-1-16-2015.pdf

Thanks for posting the document.

It seems to only talk about the iOS version relevance. There's no mention of model type and the document is 18 months old.

What about the Secure Enclave issue ever since the 5S? If it's no impediment to the IP Box so long as on pre-iOS8 then why is it generally held in most circles that no one has ever broken into an iPhone with a Secure Enclave?

Roughly since when has the IP Box been a feature of most law enforcement forensic labs?

What's your experience of this? My experience is most defence solicitors advise their client not to give out passwords and the like in interview.

If your in the UK, Section 49 of RIPA means they can charged for failing to provide a password. Up to 5 years for CSE offences. That often helps.

What's your experience of this? My experience is most defence solicitors advise their client not to give out passwords and the like in interview.

If your in the UK, Section 49 of RIPA means they can charged for failing to provide a password. Up to 5 years for CSE offences. That often helps.

This is a useless piece of legislation. Only one person was ever prosecuted for it.

Now even when people refuse to comply no further action is taken. The most blatant example is the NCA Laurie Love case.

Pretty sure I've had more than 1 conviction using this legislation…
And there is case law on it for terrorism offences.

Well I would assume most every phone that an examiner gets is powered off due to having run flat, unless a case was so urgent it got handed in under a day?

Absolutely! )

What's your experience of this? My experience is most defence solicitors advise their client not to give out passwords and the like in interview.

Then I'm sorry for you - but in my experience (and we had a quick straw poll in the office here), there are probably 25% iDevices which we cannot get into because the owner refused/forgot the passcode. So that's a significant amount of devices where the passcode is provided.

This is a useless piece of legislation. Only one person was ever prosecuted for it.

This doesn't make it useless! )

Then I'm sorry for you - but in my experience (and we had a quick straw poll in the office here), there are probably 25% iDevices which we cannot get into because the owner refused/forgot the passcode. So that's a significant amount of devices where the passcode is provided.

What usually happens with these devices once the case is concluded? Are they returned to the owner regardless of what they may hold as they have undeniable rights to the property? Or are they held onto as evidence until such time as they can be examined (if ever)?