Can someone tell me if an iPhone XS Max running iOS 13 with an unknown 4-digit passcode can be forensically unlocked and examined for deleted SMS and iMessages?
Coincidently Elcomsoft released this blog today.
https://blog.elcomsoft.com/2020/07/the-iphone-data-recovery-myth-what-you-can-and-cannot-recover/
Can someone tell me if an iPhone XS Max running iOS 13 with an unknown 4-digit passcode can be forensically unlocked and examined for deleted SMS and iMessages?
I think there is a way for unlocking it up to iOS 13.5, but it takes some time and costs some money.
Once unlocked, FFS acquisition is possible using the unc0ver jailbrake.
Jailbrake means full root access, so no, encryption wouldn't be a problem for doing a full filesystem acquisition!
@passcodeunlock Ok and your sure that method would work on the iPhone XS Max with iOS 13.5?
Yes, once the device is open and jailbroken, FFS is possible, I'm sure about that.
@passcodeunlock Ok thank you. And would this method be able to recover all deleted SMS/iMessage and safari history?
I'm not from the weather channel to predict things.
The only way to find out is actually trying it ?!
@passcodeunlock Thanks for your help. I’m about to spend almost £2000 for a private company to do this so I’m just trying to get as much information from diffrent sources as possible. Looks like it’s going to just be a gamble. Anyway I appreciate your information
If you are LE, GreyKey could be used to solve your problem.
If by the private company you mean Cellebrite Advanced Services, that will do it.
All other options are only a waste of your time and money.
Using a company called MSAB. I’ve had very mixed reviews
No need to worry. They are a big compagny and will deliver.
@fissa I’m sure they are really good at what they do I’m just worried that the setup and the security/encryption measures on this type of device/iOS system is going to be difficult for any company looking to recover deleted data