Practical Mobile Forensics - Second Edition

Bypassing the passcode

iOS devices provide an option for users to set a passcode on their device to prevent unauthorized access. Once a passcode is set, whenever the device is turned on or awakened from sleep mode, the passcode is required to access the data. Depending on the settings selected by the user, the iOS device may remain unlocked or automatically lock after a set amount of time. However, just because the device is in the unlocked state does not mean an examiner can connect it to a forensic workstation and forensically acquire the data without any issues. Some acquisition methods require the device to reboot, which will lock the device upon start-up. Additionally, some acquisition methods require the examiner to enter the passcode on ...