Russia wants apple to unlock iPhone belonging to killer!

you can't search for malware

Why not?

We can't extract malware from an iPhone. But, we can use other ways which can indicate the iDevice contains malware.

Update MacReports says the Russian team could not technically hack the 4-digit pass code, however, they have been able to retrieve data from the device by using other means, which they have not divulged.

Link

An interesting topic, didn't know weather to put this in the phone forensic section or here, so I just put it here.

Anyways, read a lot of different opinions on this on facebook, but I want to hear what you guys think. I say they even got a physical rip of the phone. Apparantley it's an iPhone 4s, but with the latest update, then I guess to modern commercial standard, it's pretty close to impossible to break into. Here it is,

Russia wants apple to unlock iPhone belonging to killer...

it can be done by nand mirroring attack

https://assets.documentcloud.org/documents/3109052/NANDmirroring.pdf

Phone model is not important here - even 5S with turned on trigger for wipe can be unlocked if we talking about 4 digits code. Important is SW so iOS version…anything higher than 8.1 has got patched bug CVE-2014-4451 hole in iOS and due this it's not possible to enter codes without wipe (counter will rise each try)….

Cellebrite's exclusive unlocking and decrypted physical extraction capabilities support the following devices
iPhone 4S / 5 / 5c, iPad 2 / 3G / 4G, iPad mini 1G, and iPod touch 5G running iOS 8.x (8.0 / 8.0.1 / 8.0.2 / 8.1 / 8.1.1 / 8.1.2 / 8.1.3 / 8.2/ 8.3 / 8.4 / 8.4.1) or iOS 9.x (9.0 / 9.0.1 / 9.0.2 / 9.1 / 9.2 / 9.2.1 / 9.3 / 9.3.1 / 9.3.2)

Link

To clarify - I talked about BF attack and they use combined attack scheme - NAND copy then NAND write, enter 8-9 codes, NAND write, enter 8-9 codes ….loop.

As many know you can use KZT adapters (https://scontent.fwaw5-1.fna.fbcdn.net/v/t1.0-9/15781256_1275727225835081_1548277887004329683_n.jpg?oh=47ae939b8924cf7e358f9113c7243eca&oe=58E04A2F) to run NAND over a PCB board (connect there flex testing tape and LCD, power supply and run phone on table) - then make BF attack on it and rewrite every few tries - as already been told here there was test of mirroring attack already available. Now just lets wait for automated solutions 😉