Practical Mobile Forensics - Fourth Edition

Password protection and potential bypasses

We want to start with the bad news: if you are examining an iPhone that runs iOS 8 or newer, and especially if it's a newer device, for example, the iPhone 6s, your chances of unlocking it are not good at all.

Of course, there are some hardware-based solutions, such as IP-BOX 3, but all of them work only occasionally, and using one of them can even result in bricking the device. With iOS 11, this problem becomes even more severe – even if the device under examination is not passcode protected, you will need the passcode anyway as it must be entered to confirm the trust between the device and your workstation.

So, what should a mobile forensic examiner do? Use the lockdown files! The lockdown files, ...