±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 7 Overall: 36105
New Yesterday: 9 Visitors: 132

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iPad and iPhone in 'Activate' mode after factory reset

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

Adam10541
Senior Member
 

iPad and iPhone in 'Activate' mode after factory reset

Post Posted: Jun 19, 18 04:18

Curious if anyone has a method for downloading iPhones or iPads when they are in the 'activate' stage after a factory reset (showing the hello screen and you have to choose language, location etc)

iPhone 5 and iPad A1475 specifically. I'm not expecting anything to remain but need to at least make the effort to show this.  
 
  

passcodeunlock
Senior Member
 

Re: iPad and iPhone in 'Activate' mode after factory reset

Post Posted: Jun 19, 18 12:48

When factory reset happens, the previously used encryption keys are also deleted, so it it pretty impossible to gather useful (decrypted) data from the chip.

There are theories about the wear levels and re-allocations, which might contain partial data from the previous usage, but I never met a real life case where anything useful could be recovered after a factory reset.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

Adam10541
Senior Member
 

Re: iPad and iPhone in 'Activate' mode after factory reset

Post Posted: Jun 20, 18 06:53

that's been my experience as well, but was mainly curious if anyone had successfully processed them in this state (regardless of any actual data located)

I could finish the activation process and link it to my local wifi, but forensically speaking that makes me shudder to even consider, but failing that I'm not aware of any other way I can actually show that no data is available...other than verbally saying it is so.  
 
  

passcodeunlock
Senior Member
 

Re: iPad and iPhone in 'Activate' mode after factory reset

Post Posted: Jun 20, 18 09:07

Don't modify the device in any way, if you do anything like that, the evidence is void no matter of it's data.

Take the phone to the closest official Apple service, pay an hour service time and get a legit paper from them stating what data is available from the phone.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

Mark_Eskridge
Member
 

Re: iPad and iPhone in 'Activate' mode after factory reset

Post Posted: Jun 20, 18 17:13

Just take a photograph of the welcome screen; which is fairly clear evidence that the iDevice has been reset.  
 
  

passcodeunlock
Senior Member
 

Re: iPad and iPhone in 'Activate' mode after factory reset

Post Posted: Jun 20, 18 22:25

If the case is important I doubt that a picture like that would be taken in consideration.

Try the Apple service, you got nothing to loose and you could end up with an official paper from them stating that the device has no active user data.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

JohnBerman
Newbie
 

Re: iPad and iPhone in 'Activate' mode after factory reset

Post Posted: Feb 20, 19 08:27

I suspect that all the data on the iPad models have been deleted and gone for good, but this shows that someone is trying to cover up some things.  
 

Page 1 of 2
Page 1, 2  Next