I wouldn't call these tools "Scary" unless you're a criminal. These tools have been used to build networks of previously unknown terrorists, put murderers in ja

I wouldn't call these tools "Scary" unless you're a criminal. These tools have been used to build networks of previously unknown terrorists, put murderers in jail (two of which I had the pleasure of testifying for in high profile cases pro-bono), and frequently (on a daily basis) finds smoking guns in child rape and molestation, grand theft, kidnapping, and a number of other cases to which you should be thankful that you are entirely oblivious to. If you knew what really went on in our society, you'd be helping the good guys out too. I imagine you probably have in your mind some redneck cop pulling you over and checking for text messages on your phone illegally, or some other stupid misappropriation of authority... 99.99% of the time, these tools are used for the right purposes, and against people who might be living on your street, committing unspeakable offenses in private. Now, as for the tools, saurik is entirely correct. The PIN code is, for the most part, just a GUI lock - think of it as a screen saver lock. The file system is encrypted on the chip, but applications need to be able to read and write from the file system. If you read the FAQ, I make no secret about how this works: we boot a custom RAM disk (from DFU mode) that mounts the disk. The kernel takes care of the decryption and because we're not actually booting the OS on disk, we don't have any pesky screen saver lock or anything else to even content with, though if we did, the forensic imaging process runs entirely in the background, and has the same level of access (root) that most of Apple's processes do. As for encryption, what IS encrypted on disk that you can't get from the file system includes keychain passwords, HFS journal (to undelete files, thanks to Jean-Baptiste's most awesome code), and files protected with iOS' data-protection classes. These files are few and far between. In fact, a vast majority of the evidence you'll find on an iPhone is entirely unencrypted. For the files that ARE encrypted, Jean-Baptiste's brute forcing and decryption tools allow us to extract the master encryption keys from the device. Each keychain password is encrypted with its own key ("AES wrap"); we apply the device's keys to this wrap, decrypt the password's key, then use that key to decrypt the password. Apple's data-protection classes are about the same. Each file is wrapped and we use one of the class keys to ultimately decrypt the file. This includes the few files on the device that are encrypted, such as email + attachments, and some third party data files using this encryption. Once you unwrap that, you'll find that even applications using their own encryption code are storing keys in the keychain - so once the keychain is decrypted, the keys to these third party crypto stores are equally exposed. The moral of the story here is that the only GOOD way to protect files is 1. To encrypt them (something Apple really doesn't do very well), 2. To have the encryption depend on a very complex key that only the owner has knowledge of and must supply in order to decrypt the files, and finally 3. To protect the device in such a way that the key cannot be intercepted by trojans or other malware. Unfortunately, iOS fails on all of these counts, making it very easy (thanks to many world class hackers contributing code) to defeat all of the encryption on the device, and MOST of the encryption even when the device is password locked. Scary? What's scary here is just how neglected security is on mobile devices, and how easy it would be for me, or Saurik, or anybody who can use code.google.com to steal all of the data on your device in just a few minutes.