FileVault The Secure Enclave And Apple Encryption

FILEVAULT & SECUREENCLAVE · AGUIDEFORUKLAWYERS FileVault, the Secure Enclave and Apple Encryption Why the Data Is Locked to the Machine and the Person, and Where the Recovery Keys Live COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM RECOVERY-KEY ANALYSIS CPR PART 35 EXPERT REPORTS FULL CHAIN-OF-CUSTODY DOCUMENTATION § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: bound to machine and person 03 How Apple encryption works: FileVault and the Secure Enclave 04 Why decryption is tied to authentication 05 Recovery keys and where they live 06 Honest limits on locked and powered-off devices 07 Deployment: lawful access, orders and the escrowed key 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary The headline point: Apple encryption binds a device's data to both the specific machine and successful the recovery keys live and how to obtain access lawfully, not how to break the encryption. § 0 2 · FIRSTPRINCIPLES The problem in plain English: bound to machine and person § 0 3 · HOWAPPLEENCRYPTIONWORKS How Apple encryption works: FileVault and the Secure Enclave FILEVAULT WRAPPED KEY SECURE ENCLAVE AUTHENTICATION DECRYPTED DATA § 0 4 · TIEDTOAUTHENTICATION Why decryption is tied to authentication § 0 5 · RECOVERYKEYS Recovery keys and where they live § 0 6 · HONESTLIMITS Honest limits on locked and powered-off devices § 0 7 · DEPLOYMENT Deployment: lawful access, orders and the escrowed key § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE HELD ESCROW / IPHONE / THE ORGANISATION RECOVERABLE DEVICE KEY ROUTE USER- ICLOUD PAIRED KEY DATA IPAD § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THEESCROWEDKEYTHATOPENEDTHEDEVICE EXAMPLE2 · THECORPORATEDEVICETHEEMPLOYERCOULDOPEN EXAMPLE3 · THEHONESTLIMITTHATSETTHESTRATEGY § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORENCRYPTED - DEVICE AC CESS 1. Please: (1) advise immediately on preservation, in particular keeping the device powered on and § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The encrypted-device checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions Can you break FileVault or extract the key from the chip? What is a FileVault recovery key, and why does it matter? Why can't you just copy the disk and decrypt it elsewhere? The device is company-owned. Does that help? If the device is locked and no key exists, is the data gone? Why does it matter that a recovery key is escrowed in iCloud? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY