Ipad set to Factory Restore
I have an iPad that was seized and needs to be examined. However it appears a factory reset was performed on it prior to our seizing the device. So I am not sure which OS it was using. Is there a way to recover data from an iPad that has been reset? I researched online and everything I located indicates you need either access to the itunes or icloud backup, but there is not one in this case for this device (at least not that we are aware of). Would Cellebrite or Lantern by Katana Forensics be a viable option? All I have is a Susteen with only logical recovery capabilities.
Malazan - From what I have been told/learned in the past, you will not be able to recover any user data from the device itself. A factory reset wipes the Master Encryption Key which is used to decrypt/encrypt the user data on the device. As you mentioned, if you had access to iTunes backup or iCloud you could get that data from there, but it looks like these don't exist.
If the device was an iPad 1, and the device was delivered with iOS 3 initially, and never reinstalled, only upgraded, then there might be a chance that a RAM disk capable forensic software solution could extract data since the file system was then likely not encrypted. The data would then be found in deleted files in the file system.
If not, then searching for iOS backups or iCloud backups would be the only option.
If the iPad is running iOS 7 or earlier, the NVRAM will contain some useful info including the time the erase started and successfully completed. You can also query via file relay to see the file dates/times of the current structure. Please feel free to reach out to me at firstname.lastname@example.org for more help.
Would Cellebrite or Lantern by Katana Forensics be a viable option? All I have is a Susteen with only logical recovery capabilities.
I have had this same issue, and used Cellebrite, Katana, and attempted Paraben on the iPad. No luck at all! I was fortunate enough to have the PC as well which contained an iTunes backup file.