iPhone is disabled ...
 
Notifications
Clear all

iPhone is disabled connect to iTunes

10 Posts
6 Users
0 Likes
1,116 Views
(@illwill)
Posts: 17
Active Member
Topic starter
 

Have an iPhone 5 CDMA model A1429 brought to me that is locked with the message "iPhone is disabled connect to iTunes" her kids were messing with phone and locked the phone, it was never synced with a computer so that option is out. I did find a flaw that allowed me to view contacts and recent call list but she just needs the pictures recovered from the phone.

I'm not sure if there is any new software with the ability to do this, I am only familiar with ones that works with iPhone 4

 
Posted : 13/10/2014 6:25 am
(@illwill)
Posts: 17
Active Member
Topic starter
 

noone?

 
Posted : 22/10/2014 10:11 pm
(@mark_adp)
Posts: 63
Trusted Member
 

This issue has been raised before. Check our the follow threads

www.forensicfocus.com/Forums/viewtopic/p=6570586/

www.forensicfocus.com/Forums/viewtopic/t=9281/

www.forensicfocus.com/Forums/viewtopic/t=12172/

 
Posted : 23/10/2014 1:27 pm
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Can you put the phone in DFU mode?

If yes then you can use UFED, XRY, iXam and various other tools to dump the content, if no then have a read of those other threads linked above and see if any help.

 
Posted : 23/10/2014 1:49 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

This issue has been raised before. Check our the follow threads

www.forensicfocus.com/Forums/viewtopic/p=6570586/

www.forensicfocus.com/Forums/viewtopic/t=9281/

www.forensicfocus.com/Forums/viewtopic/t=12172/

Which are ALL about previous (DIFFERENT) versions of the iPhone or for other (DIFFERENT) issues and that provide NO added or useful info to what the OP posted.

It is a iPhone 5 (and NOT a 4 or a 3) and it has been NOT synced to iTunes on any PC.

jaclaz

 
Posted : 23/10/2014 5:31 pm
(@mark_adp)
Posts: 63
Trusted Member
 

Which are ALL about previous (DIFFERENT) versions of the iPhone or for other (DIFFERENT) issues and that provide NO added or useful info to what the OP posted.

It is a iPhone 5 (and NOT a 4 or a 3) and it has been NOT synced to iTunes on any PC.

jaclaz

You're right, these post were regarding other, older versions of iPhone hardware but unfortunately the same issue is present here, and it having not been iTunes synched simply makes the issue more tricky.

If the device is disabled, and its iPhone 4S + then it isn't possible AFAIK to recover it without loosing all the data. Even if you get the device into DFU mode, Cellebrite will not be able to do anything with iPhone 4S and above as there is no known boot ROM exploit that allows them to boot their own custom ROM to bypass this disable issue. RonS (cellebrite) will be able to confirm this, or tell you that I'm talking rubbish!

The only known exploits an iBoot exploit?? and a soft jailbreak that uses false ln (links) in a savvy way to obtain root, but for these to work you need access to the OS, which in this case is obviously not possible.

Chip-off/JTAG is also not possible, although you will get the data off, it will all be encrypted.

As far as i'm aware, once the device shows 'Disabled' the encryption keys in the effaceable area of the NAND are deleted. The NAND memory on iPhones have been cleverly "partitioned" to stop any encryption keys from being subjected to wear levelling rules which may otherwise allow for old key recovery. Annoyingly secure.

 
Posted : 23/10/2014 5:51 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

You're right, these post were regarding other, older versions of iPhone hardware but unfortunately the same issue is present here, and it having not been iTunes synched simply makes the issue more tricky.

Yes, I believe there may be some exploits for the iPhone5 but they are - at best - "shaky" and there is not AFAIK an "accepted/acceptable" method for it.

I think that DFU mode is possible on the iPhone5, but there is not (yet) a method to dump the data. ?

The real issue is that (in this specific case) the security features - which may in themselves be a good idea - have turned the other way round and locked the legitimate owner out of the only things meaningful to her, her DATA, possibly family pictures and the like, i.e. something not replaceable ( .

I know how for people members of this forum it is "pure folly" to have any data without a proper backup, but until the majority of "common users" will not get the message that the more a device is "secure" the more care they should have with the data in it, stories like this will be common, and the engineers seemingly do not understand how likely to happen are this kind of issues.

I mean, it has been "unfortunate" that a backup was never made, and I personally find "inappropriate" to let the kids play with a costly device that can be locked by accident, but still if the good Apple guys had inserted a "better" safeguard against these cases (let's say a three days delay before allowing to enter again an unlock password) they would have made a much more satisfied customer without actually reducing much the security of the stupid device.

jaclaz

 
Posted : 23/10/2014 7:37 pm
(@deltron)
Posts: 125
Estimable Member
 

I believe time is your only hope in this matter; also you mention no sycn to the computer, but how about the cloud https://www.icloud.com/.

Most exploits are to view contacts or send messages but nothing really to bypass the lockscreen; and I believe UFED hasn't caught up. It seems to be a stalemate.

 
Posted : 23/10/2014 7:58 pm
(@mark_adp)
Posts: 63
Trusted Member
 

I think that DFU mode is possible on the iPhone5, but there is not (yet) a method to dump the data. ?

It may well be possible to boot the device into DFU mode, but afaik, this would be fruitless, as no boot rom exploit is available for this series of iPhone chipsets. Brings us back to the previous postings I posted, if its 4S+ and disabled, its iTunes restore which deleted all data.

 
Posted : 23/10/2014 11:46 pm
 p0ck
(@p0ck)
Posts: 1
New Member
 

Hi!

I got a disabled iPhone 5 and the victim had not synced the phone with her computer (no mobilesync folder) HOWEVER she had at some point (maybe to charge the phone) connected the phone to her computer and pressed "Trust this computer" which created a plist file on the computer.

I guess that you already have checked it but if you find a plist file in the "lockdown" folder (Windows ProgramData\Apple\Lockdown | MAC /private/var/db/) you will be able to extract the info.

If you have the plist file and she remembers the lock code you will be able to unlock it and she will be able to use it as normal.

Regards
Robert

 
Posted : 24/10/2014 1:25 pm
Share: