Page 1

IPHONE & IPADFORENSICS · A GUIDE FOR UK LAWYERS iPhone and iPad Forensics: The Acquisition Challenge Why the Phone in the Evidence Bag Is the Hardest Device to Open, and What Decides Whether It Can Be COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM LOCK-STATE & PASSCODE ASSESSMENT CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the richest device, the hardest to open 03 Why iOS resists acquisition 04 The factors that decide what can be obtained 05 Handling at seizure: the decisive first moments 06 Setting realistic expectations honestly 07 Deployment: preservation, access and the estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary acquire, because everything is encrypted and passcode-bound and the phone actively resists extraction, so much can ever be recovered.

§ 02 · FIRST PRINCIPLES The problem in plain English: the richest device, the hardest to open

§ 03 · WHYIOSRESISTS Why iOS resists acquisition ENCRYPTED SECURE CHIP ATTEMPT LIMITS AUTO-LOCK REMOTE WIPE