How do you legally and safely extract evidence from a locked iPhone or Android phone without accidentally wiping the data? This is the core problem of mobile device forensics, and it is a major focus of the 312-49 exam because modern criminals carry their entire lives on their smartphones. For a beginner, understanding the 'why' behind each step—from securing the device to decoding the file system—is far more important than memorising specific tool commands.
Jump to a section
A simple way to picture Mobile Device Forensics: iOS and Android
When a plane crashes, investigators first secure the flight recorder (the 'black box') because its data is fragile and can be overwritten. They immediately put it into a 'read-only' mode to stop any new data from being written over the old. They don't just pull it out and plug it into a laptop because doing so might change the last few seconds of critical flight data.
In mobile forensics, the moment you find a suspect's phone, it is like finding that flight recorder. The phone is constantly writing new data — new text messages, app notifications in the background, and system logs. If you just pick up the phone and start tapping the screen to 'look around', you are like a crash investigator who absent-mindedly presses buttons on the recorder, potentially corrupting the very evidence they need.
This is why a forensic examiner uses a 'Faraday bag' (a signal-blocking pouch) first, just as the crash team isolates the recorder from any electrical interference. They then use a specialised 'forensic acquisition tool' to create a bit-for-bit copy of the phone's storage (a 'forensic image'), working only on the copy, never the original. If they need to bypass the lock screen (like accessing the recorder's data without the key), they use specific 'checkm8' or 'brute-force' techniques that are designed to leave no new trace. The goal is to preserve the digital 'last words' of the device exactly as they were at the moment of seizure.
Mobile device forensics is the process of recovering digital evidence from a mobile phone (like an iPhone or Android device) in a way that is legally admissible in court. Because phones are constantly changing—they receive messages, update apps, and log system events—the examiner's first job is to freeze the device's state before any evidence can be lost or overwritten.
The process begins with preservation. The moment a device is seized, it is placed into a Faraday bag or RF-shielded container (RF stands for radio frequency). This blocks all cellular, Wi-Fi, Bluetooth, and NFC signals. Without this step, the phone could receive a remote wipe command from a server or an accomplice, which would erase all user data. The bag also stops the phone from syncing with iCloud or Google servers, which might overwrite local data with cloud data.
Next comes acquisition, which is the technical term for creating a perfect copy of the device's storage. There are three main levels of acquisition: - Logical acquisition: This is like reading a book by looking at the table of contents and a few selected pages. The examiner uses a tool to read the phone's file system through its operating system. It is fast and does not require breaking the encryption (the scrambling of data to make it unreadable without a key), but it only recovers files the phone's OS (operating system) is willing to show. Deleted files and system logs are usually missed. - Physical acquisition: This is like taking a photograph of every single page of the book, including the empty pages where text was erased. The examiner accesses the raw flash memory chips directly, bypassing the phone's OS. This can often recover deleted files (because the phone just marks them as 'deleted' but does not physically overwrite the data immediately). Physical acquisition is more invasive and may require breaking the phone's screen lock or using a special low-level technique. - File system acquisition: This sits between the two. The examiner gets access to the full file system structure (like the book's index and all chapters) but not the raw memory sectors. It is useful when the phone's security model (like iOS's data protection) makes a full physical read impossible without the passcode.
For iOS devices (iPhones and iPads), the biggest challenge is Apple's iOS File System Encryption. Every modern iPhone uses hardware-based encryption where the decryption key is tied directly to the user's passcode. This means if you cannot guess or bypass the passcode, you cannot decrypt the device's data. The 312-49 exam focuses on two workarounds: - Checkm8 (a bootrom exploit): This is a hardware-level vulnerability affecting older iPhones (iPhone 4s to iPhone X). It allows an examiner to bypass the passcode and read the device's memory because the exploit runs before the operating system loads. It does not work on newer iPhones (iPhone 11 and later). - JTAGing (Joint Test Action Group): This involves soldering wires to specific test points on the phone's circuit board to access the memory directly. It is rarely used in the field because it is destructive, risky, and requires advanced hardware skills.
For Android devices, the challenges are different because of the diversity of manufacturers. Android does not have a single encryption method. Older devices (Android 5.0 and earlier) used Full Disk Encryption (FDE) , where the entire user data partition was encrypted as one block. Newer devices (Android 7.0 and later) use File-Based Encryption (FBE) , where different files are encrypted with different keys. This allows the phone to ring (and show caller ID) even when locked, because the 'phone' app files are encrypted with a key that is available before the user unlocks the screen.
The key difference for forensics is that with FBE, examiners can sometimes access non-critical files (like the dialler logs or some app caches) without the passcode, because those files use the 'device-encrypted' key. But the user's photos, messages, and emails are 'credential-encrypted' and remain locked.
To bypass the lock screen on Android, examiners use techniques like: - Brute force using the bootloader: The bootloader is the code that runs first when you turn the phone on. Some phones allow an examiner to flash (overwrite) the bootloader with a custom version that disables the lock screen. This is where understanding fastboot and OEM unlocking becomes important. - Chip-off forensics: This involves physically removing the flash memory chip from the phone's circuit board and reading it with a specialised chip reader. This is a last resort because it is destructive and requires re-soldering the chip, but it works even if the phone is damaged. - Rooting the device: This means gaining superuser administrative access. On some Android phones, gaining root access allows the forensic tool to read the entire file system, including the parts hidden by the encryption wrapper.
A major exam topic is the order of volatility. This principle states that you must collect the most volatile (easily lost) data first. On a phone, the most volatile items are: 1. RAM (Random Access Memory): This is the phone's short-term memory where active apps and their passwords are stored. It disappears the moment the phone loses power. 2. Network connections: Active Wi-Fi or Bluetooth connections can be lost quickly. 3. Running processes: The list of currently open apps. 4. System logs: Temporary log files that can be rotated (overwritten) by the OS. 5. User data: Photos, messages, contacts — relatively stable but can be deleted by the user.
The final core concept is hash verification (a hash is a unique digital fingerprint of a file). After creating a forensic image, the examiner generates a hash (using algorithms like MD5 or SHA-256) of the original device and the copy. If the two hashes match, the copy is an exact duplicate, proving it has not been tampered with. This is critical for the evidence to be admitted in court.
Preservation and Isolation
Immediately place the mobile device in a Faraday bag or RF-shielded container. This blocks all cellular, Wi-Fi, Bluetooth, and NFC signals, preventing remote wipe commands and cloud synchronisation. Document the device's power state, whether it is connected to any peripherals, and the IMEI/MEID number.
Documentation and Photography
Take photographs of the device from all angles, noting any physical damage, the screen showing the lock screen, and the device's case or model number. Record the battery level, the last known signal strength, and any visible notifications. This creates a chain of custody record that shows the device's condition at seizure.
Choosing the Acquisition Method
Based on the device model, OS version, and encryption type (iOS Secure Enclave vs Android FDE/FBE), decide between logical, file system, or physical acquisition. For iOS, check if the device is vulnerable to checkm8. For Android, check if the bootloader is unlockable. The choice directly impacts what data can be recovered.
Performing the Acquisition
Connect the device to a forensic workstation using a specialised tool (e.g., Cellebrite UFED, MSAB XRY). If performing a physical acquisition, the tool will create a bit-for-bit copy of the NAND flash. If the device is locked, the tool may attempt to bypass the lock screen using exploits or brute force. The tool generates a forensic image file (e.g., .dd, .e01) and stores it on a write-protected drive.
Hash Verification and Integrity Check
Immediately after acquisition, compute the hash (using MD5 or SHA-256) of the original device's storage and of the forensic image. If the hashes match, the image is a perfect duplicate. This is critical for court admissibility. Document the hash values in the report.
Analysis and Reporting
Analyse the forensic image using tools like EnCase, FTK, or X-Ways Forensics. Recover deleted files, parse app databases (e.g., WhatsApp SQLite files), and extract timestamps, contacts, and GPS locations. Compile a report that includes the methodology used, the evidence found, and the hash values. The report must be understandable to non-technical investigators and legal professionals.
Imagine you are a digital forensic analyst working for a police force. You receive a suspect's iPhone 12 that was seized after a drug bust. The phone is locked with a 6-digit passcode, and the suspect refuses to provide it. The investigating officer needs to know if the suspect was communicating with a known dealer via WhatsApp.
Your first action is to check if the phone is still powered on. It is. You immediately place it into a Faraday bag to stop any remote wipe or cloud sync. You then check the phone's case and ports for any signs of tampering or moisture. You document the phone's condition with photographs and note its IMEI (International Mobile Equipment Identity — a unique 15-digit number for mobile devices).
Because this is a modern iPhone (model 12, so post-iPhone X), the checkm8 exploit will not work. You must use a physical acquisition tool like Cellebrite UFED or MSAB XRY. You connect the phone via a Lightning cable to the Cellebrite device. The tool detects the iOS version (iOS 16.2). The tool's software shows an alert: 'Device uses full file system encryption. Brute force of 6-digit passcode is not feasible due to iOS 16's limited attempts (10 attempts wipes the device).'
You now have a decision to make. The 312-49 exam teaches you that there are three paths: 1. Using a bootloader exploit: Not possible on iPhone 12. 2. Using a logical acquisition with iCloud backup: If you can get a warrant to access the Apple ID, you might be able to download the suspect's iCloud backup. This is often the easiest route, but only works if the suspect has an iCloud backup and you have the password. 3. Performing a chip-off: You decide this is too extreme and will likely permanently damage the phone.
You remember from your training (and from the exam) that you can attempt a 'non-invasive' technique called NAND mirroring or NAND flash mirroring. This involves connecting to the internal memory chip through the phone's existing interfaces to slowly read the data, one sector at a time. It is slow (can take weeks) and can fail if the phone is put under too much current. However, because the phone's hardware encryption key is stored on a separate secure enclave (a tiny, isolated chip), you cannot read the main storage without the passcode.
Realistically, you will write a report stating that the data on this iPhone 12 is encrypted at rest and cannot be accessed without the passcode. You will recommend that the investigating officer request a court order compelling the suspect to provide the passcode (or use biometrics like Face ID while the suspect is in custody, though legally tricky). You will also extract any non-volatile data you can, like the IMEI and the current signal status, and you will document that the phone's last backup to iCloud was three days ago — giving the officer a lead to pursue via the cloud provider.
This scenario teaches a real-world truth: not every phone can be cracked. The examiner's job is to document the attempt thoroughly, preserve the device's state, and provide the best possible evidence to the investigating team, even if that evidence is 'we cannot access the data.'
The 312-49 exam focuses heavily on the methodology of mobile forensics, not just the tools. Expect 10-15 questions on this chapter, covering iOS and Android differences, acquisition types, encryption models, and legal constraints. The exam loves to trap candidates on the details of encryption.
Key exam topics: - iOS vs Android file encryption: iOS uses a hardware-based Secure Enclave and is generally stronger. Android uses FDE (older) or FBE (newer). The exam will ask which encryption type allows certain data to be accessed while the phone is locked. The correct answer is FBE on Android, because it allows 'device-encrypted' files to be accessed for emergency calls. - Acquisition hierarchy: You must know which type of acquisition yields the most data. The correct order (from most to least) is: Physical > File System > Logical. The exam will present scenarios like 'The phone is locked and the OS is damaged. Which acquisition technique is most likely to work?' The answer is Physical (specifically chip-off) or File System (if the file system is still accessible). - Order of Volatility: This is a classic exam question. They will list five data sources (RAM, SIM card, internal storage, external SD card, cloud backups) and ask you to order them from most volatile to least. The correct order is: RAM > Cache > System processes > Internal storage > SD card > Cloud backups. - Checkm8 limitations: The exam will ask which iOS devices are vulnerable to the checkm8 exploit. The correct answer is iPhone 4s through iPhone X (A5 through A11 chips). iPhone 11 and later (A12+ chips) are not vulnerable. - Forensic image hashing: They will ask why hash verification is performed. The correct answer is to ensure the integrity of the evidence (proving the copy is identical). They will also test the difference between MD5 and SHA-1 (both are hashing algorithms; SHA-1 is considered more secure but both are accepted in forensics). - Legal concepts: The exam will test the difference between 'consent to search' and 'search warrant' for mobile devices. They will also ask about the 'plain view doctrine' (if an officer sees illegal content on the screen while legally viewing the phone, it is admissible).
Common traps: - Confusing 'logical acquisition' with 'physical acquisition'. A logical acquisition only gets visible files, not deleted ones. - Thinking Android is always easier than iOS. While Android offers more acquisition methods (like bootloader flashing), modern Android phones with FBE and hardware-backed keys are equally difficult. - Forgetting that 'rooting' an Android device during acquisition can change the data. Rooting is considered a 'destructive' process because it modifies the system partition. - Assuming that a 'factory reset' makes data unrecoverable. In reality, a factory reset only marks the encryption keys as invalid. The old data remains on the chip until it is overwritten, and can sometimes be recovered if the encryption keys are cracked. - Mixing up 'NAND mirroring' (reading the raw NAND flash) with 'JTAGing' (using test points). NAND mirroring is less invasive.
Key definitions to memorise: - Secure Enclave: A coprocessor in iOS devices that handles encryption keys and biometric data. It is isolated from the main processor. - FBE (File-Based Encryption): Android encryption that allows different files to be encrypted with different keys, enabling certain apps to work before the user unlocks the phone. - FDE (Full Disk Encryption): Older Android encryption where the entire user data partition is encrypted as a single unit. - JTAG: A hardware debugging interface used to read memory from test points on the circuit board. - chip-off: Physically removing the memory chip to read it directly. - Faraday bag: A pouch that blocks all radio signals, preventing remote wiping. - SHA-256: A hashing algorithm used to verify the integrity of forensic images.
The first step in any mobile forensic investigation is to place the device in a Faraday bag to prevent remote wiping or cloud syncing.
Physical acquisition recovers the most data, including deleted files, because it reads the raw memory; logical acquisition only gets files the operating system chooses to show.
iOS uses a hardware Secure Enclave to handle encryption keys, while Android uses either Full Disk Encryption (FDE) or File-Based Encryption (FBE).
The checkm8 bootrom exploit only works on iPhones with A5 to A11 chips (iPhone 4s through iPhone X), not on newer models.
The order of volatility dictates that RAM must be collected before cache, which must be collected before internal storage, to preserve the most fragile evidence first.
Hash verification (using algorithms like SHA-256) is performed on forensic images to prove that the copy is identical to the original, ensuring legal admissibility.
A factory reset does not destroy the data; it destroys the encryption key, making the data unreadable but not physically removed.
Android's File-Based Encryption allows certain 'device-encrypted' files (like the dialler app) to be accessed even when the device is locked, which is a common exam trap.
Chip-off forensics involves physically removing the memory chip and is a destructive, last-resort method used when the device is damaged or cannot be bypassed.
The 312-49 exam expects you to know the legal distinctions (warrant vs consent) regarding searching a mobile device.
These come up on the exam all the time. Here's how to tell them apart.
iOS Encryption (Secure Enclave)
Uses a dedicated hardware coprocessor (Secure Enclave) isolated from the main CPU, making key extraction nearly impossible.
The encryption key is tied to the user's passcode; multiple wrong attempts can wipe the device (iOS 15+).
Recovery without the passcode is extremely limited; checkm8 works only on older devices.
Android Encryption (FBE)
Uses software-based encryption with a Trusted Execution Environment (TEE) that is less isolated than Secure Enclave.
File-Based Encryption allows some files (e.g., dialler app) to be accessed without full unlock, which is a forensic opportunity.
Bypass methods like bootloader flashing or rooting are possible on some models but can be destructive.
Logical Acquisition
Returns only files the operating system is willing to show; deleted files are not retrievable.
Requires the device to be unlocked (or use a bypass) to access the file system.
Faster and less invasive; often the first attempt, but limited in scope.
Physical Acquisition
Reads raw NAND flash memory, potentially recovering deleted files and system areas.
Can be performed even if the device is locked, using hardware exploits or chip-off.
Slower, more complex, and may require destructive methods (chip-off, JTAG).
Checkm8 Exploit (iOS)
A bootrom exploit that works at the hardware level, allowing bypass of the lock screen on A5-A11 chips.
Does not work on devices with A12+ chips (iPhone XR and later).
Non-destructive; leaves no trace on the device.
Bootloader Flashing (Android)
Requires OEM unlocking to be enabled or the bootloader to be unlocked before seizure.
Can be destructive if the wrong firmware is flashed, potentially bricking the device.
Works on many Android devices but not on all (Samsung Knox devices are more resistant).
Faraday Bag (Signal Blocking)
Blocks all incoming and outgoing signals automatically without user interaction.
Can be used immediately even if the phone is locked and the screen is off.
Considered the gold standard for preservation in forensic protocols.
Airplane Mode (Manual Signal Blocking)
Requires the phone to be unlocked to toggle the setting, which is usually not possible.
Does not block GPS or NFC signals; only disables cellular and Wi-Fi.
If the phone is already in airplane mode, you must verify that it was not an active attempt to hide evidence.
Mistake
If the phone is locked, you can just plug it into a computer and download all the data like a USB drive.
Correct
Modern smartphones encrypt all user data. When locked, the decryption key is stored in a secure hardware component and is only released after the correct passcode is entered. Without the passcode, the data appears as random garbage to the computer.
This mistake comes from people's experience with older phones (pre-2015) that stored data unencrypted. People also see the phone show a 'charging' screen and assume the OS is accessible. But the file system is not mounted (accessible) until the device is unlocked.
Mistake
You can always recover deleted text messages from any phone using forensics tools like Cellebrite.
Correct
Recovery of deleted data depends on the phone's storage technology and whether the sectors have been overwritten. On modern iPhones with flash memory and TRIM (a command that tells the controller to erase unused data blocks immediately), deleted messages are often unrecoverable because the controller overwrites them almost instantly. On older Android phones, recovery is more likely.
TV shows and movies always show forensic experts recovering every deleted message instantly. In reality, flash memory management (wear levelling and TRIM) makes recovery unpredictable and often impossible.
Mistake
A factory reset makes all data on the phone permanently unrecoverable.
Correct
A factory reset on most modern phones (both iOS and Android) only deletes the encryption key, making the existing encrypted data unreadable. The underlying raw data still exists on the memory chips, but it is scrambled. Without the old encryption key, the data is effectively random noise. Specialised hardware-based attacks (like chip-off and brute-forcing the old key) are theoretically possible but extremely difficult and rarely successful.
People confuse 'deleting a file' with 'shredding a hard drive'. A factory reset is like throwing away the key to a locked safe — the items inside still exist, but you cannot open the safe. The average person does not understand the difference between wiping the encryption key and overwriting every bit of data.
Mistake
The 'checkm8' exploit works on all iPhones, including the latest models.
Correct
The checkm8 exploit is a bootrom vulnerability that only affects devices with the Apple A5 through A11 chips (iPhone 4s to iPhone X). It does not work on the iPhone XS, XR, 11, 12, 13, 14, or any later models because those use the A12 chip or newer, which have patched the vulnerability.
Checkm8 received extensive media coverage, leading people to believe it is a universal 'iPhone master key'. Many do not realise it is a specific, limited exploit that Apple has since fixed in hardware.
Mistake
If you have physical access to an Android phone, you can always bypass the lock screen by booting into recovery mode and using the volume keys.
Correct
Booting into recovery mode and using the volume keys to navigate a menu only works on some older Android devices (pre-Android 6.0) that lack proper encryption. Modern Android phones with FBE and a locked bootloader will not allow any system modification without the user's credentials. The recovery menu is also protected with the same passcode on many recent devices.
Many older 'how-to' videos and forum posts show this trick working on Android 4 or 5. People do not realise that Android's security model has evolved significantly, and these workarounds have been blocked.
Mistake
An examiner can always read the SIM card to get call logs and contacts, even from a locked phone.
Correct
A SIM card (Subscriber Identity Module) stores a limited amount of data: the subscriber's ID (IMSI), phone number, and a small contacts list. It does NOT store call logs, text messages, or app data. The call logs and SMS messages are stored in the phone's internal memory, not on the SIM. Furthermore, modern SIM cards are also encrypted and may require a PIN to access.
People associate the SIM card with 'everything phone-related' because it is the removable part of the phone. They do not understand the distinction between the SIM (which authenticates to the network) and the phone's internal storage (which holds user data).
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A Faraday bag is a pouch made of conductive material (like copper or nickel) that blocks all electromagnetic signals. In forensics, you place a seized phone inside it to prevent it from receiving remote wipe commands, SMS messages, or cloud sync requests that could destroy evidence.
It depends on the iOS version and the phone model. On iOS 11 and earlier, deleted iMessages were sometimes recoverable from the SQLite database. On iOS 13 and later, Apple uses more aggressive data overwriting, making recovery much harder. Physical acquisition gives the best chance, but it is not guaranteed.
A logical acquisition only reads the file system through the phone's operating system, recovering visible files like existing photos and contacts. A physical acquisition reads the raw memory chips directly, bypassing the OS, which allows recovery of deleted files and system-level data that is not normally accessible.
There is no single universal method. Options include booting into recovery mode to flash a custom bootloader (older phones), using USB debugging if it was previously enabled, using a physical acquisition tool that exploits a vulnerability, or performing a chip-off to read the memory directly. Each method has legal and technical limitations.
The Secure Enclave is a dedicated, isolated coprocessor (separate chip) inside iOS devices that handles encryption keys, biometric data (Touch ID/Face ID), and the passcode verification process. It cannot be accessed by the main processor, making it extremely difficult to extract the encryption key even with physical access.
No. A factory reset deletes the encryption key that is used to encrypt the user data, so the existing data becomes unreadable and appears as random noise. However, the raw data remains on the memory chip until it is physically overwritten by new data. Specialised recovery is theoretically possible but extremely difficult and rarely successful in practice.
You've finished Mobile Device Forensics: iOS and Android. Continue through the 312-49 study guide to build a complete picture of the exam.
Done with this chapter?