Locked Iphone 5s

No problem, good to hear! …I have been curious for the past year as have many of us; the exact methods used by Apple are not known. I'm sure if they were, those such as Elcomsoft etc would be on it!

Maybe dynamo has something to do with it! wink

DCS1094

Non-related to this, but would you be familiar with how kik messages are overwritten on an Iphone? For example, if I was trying to find a message from an individual a week ago, and since that message the app was periodically reset, and one-two thousand messages have been sent since then - should I be concerned that this message has been overwritten?

I thank you in advance for allowing me to pick your mind )

No problem, good to hear! …I have been curious for the past year as have many of us; the exact methods used by Apple are not known. I'm sure if they were, those such as Elcomsoft etc would be on it!

Maybe dynamo has something to do with it! wink

I don't really know how they get the data off as I've never requested it from apple.
But what I do know is iphones only allow signed boot loaders on iOS devices. Apple is able to sign their own boot loader that will bypass the hardware decryption to download the data.
Prior to ios7 (I can't remember what they changed from a security aspect) they encrypted all data on the phone with the hardware key except for emails which were encrypted, I think with the users password.
So apple would be able to give you that data.
Of course it would be great if they signed boot loaders for elcomsoft and cellebrite for LE use but they won't do that.

The suspect has forgotten the password due to always unlocking the device via fingerprint.

And isn't there a possibility (without cutting the guy's finger off) to use the actual finger (or a fingerprint) to access the device?
http//www.theguardian.com/technology/2013/sep/22/apple-iphone-fingerprint-scanner-hacked
http//www.zdnet.com/apple-iphone-fingerprint-reader-confirmed-as-easy-to-hack-7000021065/

jaclaz

+1 to this

Is getting a court order for the suspect to unlock the phone for you out of the question?

DCS1094

Non-related to this, but would you be familiar with how kik messages are overwritten on an Iphone? For example, if I was trying to find a message from an individual a week ago, and since that message the app was periodically reset, and one-two thousand messages have been sent since then - should I be concerned that this message has been overwritten?

Magnet have some articles about Kik recovery (and general iPhone file system info)

http//www.magnetforensics.com/ios-artifacts-see-what-you-might-be-missing/
http//www.magnetforensics.com/investigating-ios-phone-images-file-dumps-backups/

Good luck.

Rgds

Shep

Shep47

I've seen both of those articles before, but I'm guessing that I won't be able to retrieve the delete messages without a physical image. Unfortunately Apple only returns a logical image (my understanding), and the device remains locked upon return. I suppose I'm just trying to find out what I'm in for. I appreciate digging up those articles! I just wish I could find something more recent as that deals with an Iphone 3g / A lot has changed since then.

I appreciate everyone's insight on this question.

The suspect has forgotten the password due to always unlocking the device via fingerprint.

And isn't there a possibility (without cutting the guy's finger off) to use the actual finger (or a fingerprint) to access the device?
http//www.theguardian.com/technology/2013/sep/22/apple-iphone-fingerprint-scanner-hacked
http//www.zdnet.com/apple-iphone-fingerprint-reader-confirmed-as-easy-to-hack-7000021065/

jaclaz

+1 to this

Is getting a court order for the suspect to unlock the phone for you out of the question?

i'd really like to test this out
https://www.youtube.com/watch?v=V4GdfL_Eu50

have to figure out how to take that level of detail on a photocopy though

… have to figure out how to take that level of detail on a photocopy though

If you check the "original" video, it seems to me like instead of a megapararatransnuclear magnetic force imaging device a quite "normal" HP scanner and Brother printer/copying machine
http//istouchidhackedyet.com/
were used.

jaclaz

well then, hopefully will have a chance to replicate their findings