In this section, we will give you a quick overview on the difficulties of performing file carving operations on an iOS device and will help you understand why and what are the possibilities. We will also see the particular case of recovering the SQLite deleted records.
Apple uses a technology called Data Protection in order to further protect data stored in flash memory on iDevices. Every time a file is created, a new 256-bit per-file key is generated and it is used to encrypt the file content using AES encryption. The per-file key is then wrapped with one of the data protection class keys and then stored in the file's metadata, which is in turn encrypted with the filesystem key (the EMF key