±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36738
New Yesterday: 0 Visitors: 145

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Locked iPhone6 with Checkr1n

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Arbab
Member
 

Locked iPhone6 with Checkr1n

Post Posted: Jan 12, 20 18:05

Hi,

Is there any way to bypass the message on iOS device "Unlock iPhone to use accessories".

We need to bypass iPhone 6 passcode.

We tried the following method.

To bypass iPhone 6 with OS version between (12.3--13.3), we inject Checkr1n in DFU mode. After successfully injected checkr1n, we tired to connect iPhone with UFED,XRY or with Linux. we got connection issue. message popup on iPhone like "Unlock iPhone to use accessories".

We test 3 different test devices iPhone 6s, 6 and iphone 8 (Locked with bypass). after injected Checkr1n in DFU mode XRY, UFED are able to detect and do the extraction,without any trust relation popup. "As the devices are passcode locked.
BUT

After one hour if we try to do extraction again on these three test iOS deivices with XRY,UFED or via linux. message popup. "Unlock iPhone to use accessories".

Conclusions. within one hour of the locked iOS device, iPhone code can be bypass and able to do full file system extraction via UFED, or XRY.

My Question is, "is there any way to bypass the message "Unlock iPhone to use accessories". on locked devices or disable the usb accessories in setting>>Touch id and passcode >>USB Accessories.

Thanks  
 
  

Igor_Michailov
Senior Member
 

Re: Locked iPhone6 with Checkr1n

Post Posted: Jan 12, 20 20:53

BFU Extraction: Forensic Analysis of Locked and Disabled iPhones

blog.elcomsoft.com/201...d-iphones/
_________________
Computer, Cell Phone & Chip-Off Forensics

linkedin.com/in/igormikhaylovcf 
 
  

the_Grinch
Senior Member
 

Re: Locked iPhone6 with Checkr1n

Post Posted: Jan 14, 20 21:03

Checkra1n won't allow you to do a full extraction without the passcode. It will get you some data, but if you don't have the passcode for the device your stuck.  
 
  

passcodeunlock
Senior Member
 

Re: Locked iPhone6 with Checkr1n

Post Posted: Jan 15, 20 14:57

@OP: I sent you a PM.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 
  

Arbab
Member
 

Re: Locked iPhone6 with Checkr1n

Post Posted: Jan 15, 20 23:40

- passcodeunlock
@OP: I sent you a PM.



Thanks for the kind offer, we will update you soon,


Second We are able to jailbreak the device using Checkr1n v0.9.5. Which has the ability to remove this message "Unlock iPhone to use accessories".

We are able to do BFU extraction with UFED but we got very less data, i.e locations, wifi address, files. Now the challenge is '' How to decrypt the full file system, or to get more data .i.e application data, contacts, calls, sms etc''.  
 
  

the_Grinch
Senior Member
 

Re: Locked iPhone6 with Checkr1n

Post Posted: Jan 15, 20 23:52

Hook it up to GrayKey or Cellebrite's solution. As previously posted without the passcode you aren't going to get the data you are looking for.  
 
  

passcodeunlock
Senior Member
 

Re: Locked iPhone6 with Checkr1n

Post Posted: Jan 16, 20 12:48

If it is Before First Unlock, you ge some data, but you are wasting your time, it won't help you get the desired data. Please read the link posted previously by Igor:

blog.elcomsoft.com/201...d-iphones/

If you really want to move forward and the case is important enough, contact me.
_________________
Apple passcode unlock + decrypted filesystem dump, Android user locks unlock + physical dump with decrypted userdata partition. We provide our services world-wide, but we reserve the right for choosing which tasks we take and which we deny! 
 

Page 1 of 1