Page 1

FILEVAULT & SECUREENCLAVE · A GUIDE FOR UK LAWYERS File Vault, the Secure Enclave and Apple Encryption Why the Data Is Locked to the Machine and the Person, and Where the Recovery Keys Live COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM RECOVERY-KEY ANALYSIS CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: bound to machine and person 03 How Apple encryption works: File Vault and the Secure Enclave 04 Why decryption is tied to authentication 05 Recovery keys and where they live 06 Honest limits on locked and powered-off devices 07 Deployment: lawful access, orders and the escrowed key 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary The headline point: Apple encryption binds a device's data to both the specific machine and successful the recovery keys live and how to obtain access law full y, not how to break the encryption.

§ 02 · FIRST PRINCIPLES The problem in plain English: bound to machine and person

§ 03 · HOWAPPLEENCRYPTIONWORKS How Apple encryption works: File Vault and the Secure Enclave FILEVAULT WRAPPED KEY SECURE ENCLAVE AUTHENTICATION DECRYPTED DATA