Acquiring locked devices
At the start of this book, in Chapter 1, Introducing iOS Forensics, we discussed the iOS operating system and learned how Apple achieves data protection by encrypting files stored on the device.
The device's passcode is an essential aspect of the encryption process, as it is used to generate the encryption key, which, in turn, is used to decrypt the data. Until the user enters the screen lock passcode, almost every piece of data remains inaccessible. Of course, there are some exceptions, as some files are required for the operating system to work and they need to be always accessible, even when the device is locked.
For these reasons, acquiring and analyzing a locked device is no easy task but there are a few options. When an investigator is tackling a locked device, the first step requires identifying the device and its current state, as the options available to attempt data acquisition will vary depending on a number of factors, such as the model...
