Edit: It'd be really useful if someone could say where I've gone wrong here. Just sayin', y'all. This is very confusing. > “Due to end-to-end encryption emplo

Edit: It'd be really useful if someone could say where I've gone wrong here. Just sayin', y'all. This is very confusing. > “Due to end-to-end encryption employed by WhatsApp, it is impossible to decrypt the contents of the downloader to determine if it contained any malicious code in addition to the delivered video,” the investigators found. That's a pretty standard malware trick, right? It decrypts itself when it executes. So why can't they execute it in a test environment? > “During the initial attempt to collect a forensic image of the iPhone, FTI determined that the device had iTunes backup encryption enabled, and that full analysis of the contents of the forensic image would require the encryption password,” the report states. Well, then. Why didn't they get it? Too great a threat to Bezos' privacy, I guess. > They apparently never obtained the password, however, because the report states that on May 20, 2019, the investigators “tested options for bypassing the iTunes backup encryption password” and ended up resetting “All Settings” on Bezos’ iPhone X to restore the device’s settings to factory defaults, thereby “removing the encryption password while preserving the file system and any relevant data and artifacts. FTI received authorization to perform this resetting step, did so, and then commenced acquisition of an unencrypted Cellebrite forensic image.” That is totally bizarre. I mean, isn't that almost evidence destruction? You might to that to a clone, but not to the actual device. But then, I'm just a punter.