I have an Iphone 5s with a alpha-numeric password. The suspect has forgotten the password due to always unlocking the device via fingerprint.
My question is, if given a court order what is apple able to do with the device? Upon scouring the web I was able to find information leading to the belief that Apple isn't actually able to unlock the device or provide a password, but rather copy the data on the device to a DVD/USB drive.
My second question is - is this data taken from the phone decrypted by apple? Or is it simply a backup of the encrypted data?
Also, how long from beginning to end can I expect this process with Apple to take - starting with the court order?
Basically I'd just like to know what I can expect to receive back from apple. Will they also be able to provide data from deleted messages, photos, app data, etc (physical data); Or only the information that exists on the device at that moment (logical)?
Any clarification is appreciated. Thank you!
This has come up recently in the following topic
http//www.forensicfocus.com/Forums/viewtopic/t=11344/
This should answer all your questions, Good luck!
Even after reading that, I'm still a little confused. Is all the data decrypted? And is this a physical or logical backup of the phone?
From what I could gather from the post, it sounds like it's really just a logical backup of the data on the phone and that any deleted data won't be able to be acquired.
If anyone has experience with this it would be appreciated! Thank you )
The suspect has forgotten the password due to always unlocking the device via fingerprint.
And isn't there a possibility (without cutting the guy's finger off) to use the actual finger (or a fingerprint) to access the device?
http//
http//
jaclaz
And isn't there a possibility (without cutting the guy's finger off) to use the actual finger (or a fingerprint) to access the device?
I'm sure that would go down well lol Instead of writing a warrant to Apple, just chop the blokes finger off!
From what I could gather from the post, it sounds like it's really just a logical backup of the data on the phone and that any deleted data won't be able to be acquired.
Yes and No wink Even though I have never done the warrant process myself, from what I have heard Apple will provide access to data stored on an encrypted device, i.e. provide you with all Database/PList files (logical file system type approach) in a decrypted format.
In theory it is still possible to recover deleted data from within notable SQLite db files with the right tools!
I'm sure that would go down well lol Instead of writing a warrant to Apple, just chop the blokes finger off!
Knowing in advance that someone would post this, I explicitly excluded this possibility, by writing the "(without cutting the guy's finger off)" that you either did not notice or downright ignored.
jaclaz
I noticed it, just thought it was amusing hence the lol of course it wasn't a serious suggestion.
Thank you for the clarification! That's actually exactly what I was looking for )
So that actually makes me kind of curious.
How does Apple actually get the data decrypted? Do they have the decryption keys saved for individual devices? Or do they somehow force the device to do a backup, which would obviously decrypt the data as it leaves the device due to hardware encryption?
In my mind that would kind of make sense as to why it's logical and not physical extraction.