Page 1
IPHONE & IPADFORENSICS · A GUIDE FOR UK LAWYERS iPhone and iPad Forensics: The Acquisition Challenge Why the Phone in the Evidence Bag Is the Hardest Device to Open, and What Decides Whether It Can Be COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM LOCK-STATE & PASSCODE ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the richest device, the hardest to open 03 Why iOS resists acquisition 04 The factors that decide what can be obtained 05 Handling at seizure: the decisive first moments 06 Setting realistic expectations honestly 07 Deployment: preservation, access and the estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary acquire, because everything is encrypted and passcode-bound and the phone actively resists extraction, so much can ever be recovered.
§ 02 · FIRST PRINCIPLES The problem in plain English: the richest device, the hardest to open
§ 03 · WHYIOSRESISTS Why iOS resists acquisition ENCRYPTED SECURE CHIP ATTEMPT LIMITS AUTO-LOCK REMOTE WIPE
Page 2
§ 04 · THEDECIDINGFACTORS The factors that decide what can be obtained
§ 05 · HANDLINGATSEIZURE Handling at seizure: the decisive first moments
§ 06 · REALISTICEXPECTATIONS Setting realistic expectations honestly
§ 07 · DEPLOYMENT Deployment: preservation, access and the estate
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE I CLOUD BACKUP (ITUNES/ MAC / LOCKED/ THE COUNTERPART I PHONE DEVICES COMPUTER PAIRED IF DEVICE FINDER) IPAD WIPED
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEUNLOCKEDPHONETHATWASALLOWEDTOLOCK EXAMPLE2 · THEHONESTASSESSMENTTHATSETTHESTRATEGY EXAMPLE3 · THEPHONEWIPEDREMOTELYBEFOREEXAMINATION
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANIOS AC QUISITIONASSESSMENT
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The iOS acquisition checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can't you just plug the iPhone in and read it? What is the single most important thing at seizure? Why does the passcode matter so much? Can every iPhone be extracted? If the phone can't be opened, is the evidence lost? Someone might wipe the phone remotely. What do we do?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IPhone And IPad Forensics The Acquisition Challenge, Computer Forensics Lab, https://e-discovery.uk/library/iphone-and-ipad-forensics-the-acquisition-challenge/pdf.