One possible reason for that: Apple-designed processors that power iPhone 5s and newer phones feature an embedded Secure Enclave crypto-engine with its own encrypted memory and other hardware-based features aimed at strengthening security. Investigators can see Messages content sorted chronologically. Apple, naturally, wanted to learn about the exploits Cellebrite’s tool uses, but the FBI wasn’t interested in sharing that information.Ĭellebrite alluded in April it might be able to bypass the passcode protection on the iPhone 6 series, but wouldn’t comment beyond that vague statement. The FBI later said Cellebrite’s forensic tools do not work on iPhone 5s and newer and Cellebrite itself has said that it’s indeed unable to crack the passcodes on iPhone 4s and later. The FBI reportedly paid Cellebrite $1.3 million for UFED and apparently used it to bypass iOS’s passcode delay and automatic wipe features on the San Bernardino shooter’s iPhone 5c. With that in mind, had the iPhone 5 in question been protected with a passcode, the data on the phone would have been fully encrypted and iOS would have deleted everything on the device after ten failed attempts to guess the passcode. It’s important to note that the phone’s owner didn’t set up a passcode, which has left the device entirely unencrypted and more vulnerable to Cellebrite’s hacking tool. As mentioned earlier, UFED even extracted some content that had been deleted from the device, like deleted messages and photos.Ĭellebrite’s tool captures the geolocation of every photo that’s been taken. The software can also cross-reference data from the device to build up profiles across contacts, SMS and other communications. The image top of post shows the tool’s extraction report for an iPhone 5 running iOS 8.Īfter plugging the device to a machine running the tool, the officer was able to perform a logical extraction, which downloads what’s in the phone’s memory at the time. UFED can pull similar data from other phones, too, including Wi-Fi hotspots and cellular towers the device’s was connected to.

In a single data-extraction session, investigators were able to collect a huge array of personal data from an iPhone 5 like messages, phone calls, voicemails, images and more, including some deleted content. The leaked documents show just how much private data its smartphone forensic tool UFED, used by law enforcement, is capable of extracting from iPhones. Documents uncovered by ZDNet have revealed the true scope of technology from Israeli developer Cellebrite Mobile Synchronization, which specializes in smartphone data extraction, transfer and analysis.

Physical vs logical ufed reader