NB: While you are free to answer this question, there is a more specific discussion here
Excerpt from Apple's Whitepaper "iOS Security" on Effaceable Storage:
A dedicated area of NAND storage, used to store cryptographic keys, that can be addressed directly and wiped securely. While it doesn’t provide protection if an attacker has physical possession of a device, keys held in Effaceable Storage can be used as part of a key hierarchy to facilitate fast wipe and forward security
Does this mean that the system encryption is useless against forensics? Or is it only vulnerable when it's locked and not turned off?
The question relates to iOS 8+ non-jailbroken Iphone 4s+.
this blog on forensic possiblities on locked devices running iOS 8.3 has interesting points:
- Turned on and with lockdown certificate
You can create a local backup The same problem as the previous case applies if the user has previously set a backup password Be sure that the device keep charging during the backup process
- Turned off device and with lockdown certificate
Use AFC protocol and recover the most information that you can, as explained in this article
- Turned on/off device without a lockdown certificate
Only device information (name, UDID, etc.)
If I have correctly understood what a lockdown cert is it requires access to the computer used for Itunes communications with the IPhone. For this scenario, that PC is impenetrable.
SO, can someone confirm that a locked Iphone 4s iOS 8.3 cannot be cracked in the case of no access to lockdown certificate?
Furthermore, what if the same phone is powered off?
This site says
If they don't have your computer, Zdziarski claimed they can try and generate a pairing record by tricking you into connecting to a compromised accessory, like a dock (juice jacking), and/or by using mobile device management (MDM) tools intended for the enterprise to get around safeguards like Apple's Trusted Device requestor.”