PINs not working in...
 
Notifications
Clear all

PINs not working in UFED Advanced Log extractions

3 Posts
3 Users
0 Likes
1,340 Views
(@jeeper)
Posts: 6
Active Member
Topic starter
 

So after working out the Windows and drivers issues to get Checkm8 operable we are now finding that maybe 20% of cases being processed are telling us the PIN is incorrect even though the user is not hostile and the PIN is confirmed 100% to be correct. 

These cases are where the device is known to be "disabled". It seems to work for some and not others (all noted to be IOS 12+). 

Pointers?? 

 
Posted : 02/07/2020 4:04 am
passcodeunlock
(@passcodeunlock)
Posts: 792
Prominent Member
 

If the device is disabled and asks to connect to iTunes, if iOS is max. 12.1, extraction is possible. If the iOS version is higher - and probably it is, the extraction isn't possible.

For devices which aren't disabled, it is possible to extract the data using special lab services like CAS or GreyKey, up to iOS 13.5. (by today, 2020.07.04)

 
Posted : 04/07/2020 1:03 pm
(@arcaine2)
Posts: 235
Estimable Member
 
Posted by: @jeeper

These cases are where the device is known to be "disabled". It seems to work for some and not others (all noted to be IOS 12+). 

UFED, even with checkm8 exploit still has the same limitations as the device itself. If you see "disabled" message, every passcode should be refused by the device, that's expected.

 

Disabled doesn't mean that it's the dead end. In theory, and this often works, you can do a firmware update with iTunes and phone will boot into "press home to recover" screen. Once you press home it'll ask you to enter passcode twice, then try to fix itself. Is passcode is correct, it'll boot into iOS and you'll see lockscreen, if it's incorrect you'll see "press home to recover" screen again. If i remember correct, you have at least 5 more attempts this way and at some point a counter will start - with 1 minutes delay, then 5 minutes and 60 minutes in the end.

 

Of course updating firmware comes with a risk. You can get an iPhone with full storage and end up with error 14, or it can have any other random hardware/software problem that'll make update process to fail etc.

 
Posted : 14/08/2020 8:03 pm
Share: