PINs not working in UFED Advanced Log extractions
So after working out the Windows and drivers issues to get Checkm8 operable we are now finding that maybe 20% of cases being processed are telling us the PIN is incorrect even though the user is not hostile and the PIN is confirmed 100% to be correct.
These cases are where the device is known to be "disabled". It seems to work for some and not others (all noted to be IOS 12+).
If the device is disabled and asks to connect to iTunes, if iOS is max. 12.1, extraction is possible. If the iOS version is higher - and probably it is, the extraction isn't possible.
For devices which aren't disabled, it is possible to extract the data using special lab services like CAS or GreyKey, up to iOS 13.5. (by today, 2020.07.04)