That, is in fact, is not the true physical extraction, but you get the full copy of the file system, so it’s very close (and it is only a question of terminology).
Physical Acquisition for 64-bit Devices, iOS 9 Support. We implemented full file system and keychain extraction from jailbroken devices: At the time we started our work, it was only possible with a jailbreak. We concentrated on a slightly easier yet very important task in mobile forensics: the full file system extraction from unlocked devices. Since then, Apple stopped offering data extraction services for LEA. Since iOS 8, only a very limited amount of data remained unencrypted. There were two game changers: the iPhone 5s equipped with Secure Enclave and iOS 8 that seriously improved iOS data protection. Apple officially provided this service to the government. One could easily break the passcode (in most cases) and decrypt most of the data even if the passcode was not cracked. It was always possible to create a perfect bit image of the device, even if it was locked. In the time of the iPhone 4, jailbreaks were never needed. Are there any reasons to use jailbreaks for extracting evidence from Apple devices? However, extracting the file system may require jailbreaking, which may be risky and not always permitted. If you are familiar with iOS acquisition methods, you know that the best results can be obtained with a full file system acquisition.
0 kommentar(er)
