Digital Forensics: iOS Forensics – Basics

What it is

A practitioner's reference for determining exactly which extraction path applies to a seized iPhone, built around the four Data Protection classes (A–D) that govern per-file encryption and the resulting BFU/AFU state, plus the specific tools and artifact stores used once a state is established.

How it works

Data Protection assigns each file a class at creation: Class A decrypts only while unlocked and re-locks as soon as the screen sleeps (mail bodies); Class B can be written while locked but only read if already open; Class C unlocks on first passcode entry after reboot and stays unlocked even after the screen re-locks (app data, chats, photo libraries — this is the class that matters); Class D needs no passcode at all. BFU/AFU is just whether Class C has been unlocked since the last reboot. Pairing records created by "Trust This Computer" live on the host machine, not the phone, so a lab can talk to a locked-but-AFU phone via a previously-trusted computer without a new unlock — meaning every computer the owner used is as relevant as the phone itself. USB Restricted Mode cuts data over the port (charging still works) after roughly one hour locked, independent of and faster than the pairing-record route. Lockdown Mode requires the phone to be unlocked before any wired accessory can talk to it at all, which is a stricter gate than Restricted Mode's timeout.

Preconditions / Affected

Full filesystem extraction via signed agent requires AFU and current agent support for the chip — A19/M5 chips with Memory Integrity Enforcement already exceed some agent chains' capability. Checkm8-style bootrom exploits (used standalone and by Cellebrite) only run below the OS and only work on iPhone 5s through X — nothing shipping today. Cellebrite's brute-force support is limited to specific older models on specific iOS ranges, not a blanket capability against locked phones.

What to do

• Treat pairing records on known host machines as evidence sources in their own right, not just the phone.
• Act within the ~1 hour USB Restricted Mode window and well inside the ~72 hour auto-reboot window (iOS 18.1+) — labs have had properly isolated AFU phones revert to BFU just from Faraday-bag storage time.
• Don't toggle Lockdown Mode on a seized device — enabling or disabling it reboots the phone and kills AFU immediately.
• Always collect WAL and SHM files alongside chat-app SQLite databases, since deleted rows can persist in the freelist or WAL until cleanup.
• Cross-reference KnowledgeC/Biome (app focus, unlocks, notifications, web activity) against PowerLog (power/connectivity state) to reconstruct what was on-screen at a given time; use Photos.sqlite for hidden/recently-deleted images and iCloud sync state.

Caveats

The page flags that any claim of recovering deleted iMessages from raw flash on a modern iPhone "needs real scrutiny," since deletion destroys the encryption key rather than leaving carveable data. It also notes Cellebrite's tooling itself has had real bugs found in it (citing Signal's founder, 2021), and that jailbreak-derived evidence is forensically unreliable since tweaks can overwrite or fabricate artifacts.