iPhone Forensics

Restore Mode and Integrity of Evidence

Imagine an employee who has been caught selling corporate secrets. He has just discovered that he is under investigation by the company, and the company’s security officers are headed his way to interview him. The first thing he might do is to try and destroy evidence on his iPhone. He presses and holds the Home and Power buttons until the device is forced into recovery mode. Is his data gone? Can it be recovered? What if the employee had a few minutes to initiate a full restore using iTunes?

There are two steps involved in restoring an iPhone: placing the device in restore mode, and performing the actual restore with iTunes. In the scenario just described, simply placing the device into restore mode has only stopped the iPhone from booting—and temporarily at that. The “Please Connect to iTunes” display is simply the iPhone’s way of saying, “I was told not to boot up, so this is what I’m doing instead.” Simply placing a device into restore mode does not destroy the filesystem. A forensic examiner may even enter the device into restore mode himself to perform certain tasks such as circumventing passcode protection. If the owner does this, or if a mistake is made during the recovery process leaving the iPhone in recovery mode, don’t panic. All data still remains intact. The device can in fact be made to boot back into the operating system without a loss of data, provided the user has not initiated the actual restore process (by docking it and ...