Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I've probably a simple question, but could not find a (detailed) answer on the internet yet.
If my iPhone is locked (i.e. with TouchID or a PIN), is my data secure? So, can hackers or law enforcement get access to my chat history for example?
Or is it fully available in the RAM and the RAM can be read? Of course I know that there are ways to fake a fingerprint, it's more a general question.
By default all data stored on IOS filesystem is encrypted with the filesystem key which is specific to the device and securely stored. When the device is powered, the file system is unlocked for access with this key. This key is also how remote wipe works - it just destroys this key.
Files can be encrypted at rest as required using the data protection api, so this is application dependent.
RAM is a different story, applications won't be encrypting all of their data while it is in memory and RAM can be read in various ways with various tools but they would mostly require direct and privileged access to the device or for it to be compromised.
Yes, in a nutshell recent iOS versions are very secure. Devices from the iPhone 6 utilise the Secure Enclave (https://www.apple.com/business/docs/iOS_Security_Guide.pdf) and all data at rest when the device is locked is very well encrypted.
Apple have also taken steps in the hardware to prevent circumvention of the fingerprint sensor and brute forcing of the pin/passcode.
All your backups are also encrypted.
Worth noting that on unlock it does not just fully de-crypt the filesystem, it all happens on an ad hoc basis, with files being decrypted on the fly.
I would not worry about info being cached in RAM as to compromise this they would have had to unlock the device anyway.
