3 ms·

It might not be directly related but there was a news story on CNET [1] yesterday about cops in Michigan using a device from Cellebrite to download information

It might not be directly related but there was a news story on CNET [1] yesterday about cops in Michigan using a device from Cellebrite to download information from phones of people they stopped for violations that includes contacts, phone logs, messages, photographs and location history. Does Apple's decision of having such information stored on the phone unencrypted make it easy for such devices? The device claims to subvert phone passwords though. [1]http://news.cnet.com/8301-17938_105-20055431-1.html http://news.cnet.com/8301-17938_105-20055431-1.html

ImprovedSilence 16y ago
I've actually used that device before. It's fairly common in law enforcement and inteligence agencies, and it will take everything. Including passwords/deleted info. There is no reason for using it on a traffic stop though, that's just straight up invasion of privacy and would piss me off to no end. It's use is (and should be) for the more criminal/forensic cases.
- chadgeidel 16y ago
  Perhaps you could answer a question. If the phone screen is locked will this device still gather data? I assume it will.
  - pmjordan 16y ago
    iTunes will happily sync with your iDevice when its screen is locked, so locking is clearly no barrier.
    - kylec 15y ago
      If you plug your iOS device into another computer it won't connect to iTunes until you unlock the device. Whether that is enforced by the phone or iTunes I don't know.
- kovar 16y ago
  And it doesn't work on all devices out there, and doesn't fully collect the devices it does work with. Most forensics labs have multiple tools such as this, and still have issues fully collecting devices.
- huhtenberg 15y ago
  I wonder if that device utilizes some form of "law enforcement backdoor API", a phone analog of the "lawful intercept" in networking. Because frankly I don't understand how else it could retrieve previously deleted data from the phone.
  - nitrogen 15y ago
    If you look at apps like BitPim, you'll see there's a standard protocol that many phones use for syncing. That protocol gives access to far more data than you might expect. If you have USB Debugging enabled in Android, the level of access is probably similar, and even if not, they can read your entire micro SD card via USB mass storage. I don't know enough about Android syncing to say whether it's possible to access contact data via USB when the phone is not in debugging mode, or whether there's a way to activate mass storage mode or Bluetooth transfers without unlocking the phone.

ImprovedSilence 16y ago

I've actually used that device before. It's fairly common in law enforcement and inteligence agencies, and it will take everything. Including passwords/deleted info. There is no reason for using it on a traffic stop though, that's just straight up invasion of privacy and would piss me off to no end. It's use is (and should be) for the more criminal/forensic cases.

chadgeidel 16y ago
Perhaps you could answer a question. If the phone screen is locked will this device still gather data? I assume it will.
- pmjordan 16y ago
  iTunes will happily sync with your iDevice when its screen is locked, so locking is clearly no barrier.
  - kylec 15y ago
    If you plug your iOS device into another computer it won't connect to iTunes until you unlock the device. Whether that is enforced by the phone or iTunes I don't know.
kovar 16y ago
And it doesn't work on all devices out there, and doesn't fully collect the devices it does work with. Most forensics labs have multiple tools such as this, and still have issues fully collecting devices.
huhtenberg 15y ago
I wonder if that device utilizes some form of "law enforcement backdoor API", a phone analog of the "lawful intercept" in networking. Because frankly I don't understand how else it could retrieve previously deleted data from the phone.
- nitrogen 15y ago
  If you look at apps like BitPim, you'll see there's a standard protocol that many phones use for syncing. That protocol gives access to far more data than you might expect. If you have USB Debugging enabled in Android, the level of access is probably similar, and even if not, they can read your entire micro SD card via USB mass storage. I don't know enough about Android syncing to say whether it's possible to access contact data via USB when the phone is not in debugging mode, or whether there's a way to activate mass storage mode or Bluetooth transfers without unlocking the phone.