Hardening modern iPhone against forensic tools

[whoami6 (whoami)]

@NkHoszcg

@whoami6

This guide turns your device into a enterprise device which will require enterprise collection. The Cellebrite support matrix doesn’t imply they unlocked or extracted a device with proper roadblocks in place. The average joe isn’t using the roadblocks I mentioned.

Cellebrite Enterprise utilizes the iOS backup service for extraction, which is blocked by MDM. In contrast, Cellebrite Premium and CAS employ zero-day exploits for extraction, meaning they do not depend on the iOS backup service and are likely unaffected by MDM.

All FFS extractions on A12+ require sideloading an agent (app) to to the device. This applies to all forensic vendors and can be easily verified by reading here. That app cannot be installed if you follow this tutorial.

@NkHoszcg

I’ve seen the same control center video. However, I believe the reference to the control center is simply to distinguish between AFU and DFU for those who may not be familiar with the terms, and it doesn’t necessarily indicate a bug within the control center itself. It’s more probable that the issue lies with the USB controller, specifically a bug that bypasses USB restricted mode and another LPE bug that allow access to the file system.

@whoami6

Additionally, AFU exploits are only possible because most apps use the ProtectedUntilFirstUserAuthentication data protection class which doesn’t remove the decrypted class key from memory until a reboot.

That’s correct. However, very few apps utilize NSFileProtectionComplete, which would prevent AFU extraction. Even Signal employs NSFileProtectionCompleteUntilFirstUserAuthentication for its database, allowing AFU to extract the entire chat history from Signal.

This tutorial is mainly for BFU/FFS. Putting your phone in BFU is the easiest thing ever to do. Your phone is literally always on your person. AFU has too many unknowns about it. If AFU/BFU still requires sideloading that “agent” than this tutorial defeats it. If it doesn’t then turning off your phone is mandatory to prevent sensitive data from being extracted. Unless there is a new undisclosed jailbreak on the lose. Keep in mind, these forensic companies have lot’s of money and hiring a well known jailbreak dev (like Cellebrite did) and keeping them hush wouldn’t be hard.

This is why I personally like the modern iPhone + GrapheneOS combo. Use iPhone for casual texting, business stuff, gmail, apps not supported by Graphene. Use GrapheneOS for social media, password managers, proton suite, etc.