5 ms·

I think more interesting is the section about what Law Enforcement can access and what not - which is explained in detail on this page: http://www.apple.com/pri

I think more interesting is the section about what Law Enforcement can access and what not - which is explained in detail on this page: http://www.apple.com/privacy/government-information-requests/ http://www.apple.com/privacy/government-information-requests... The page also contains three PDFs with more details for US/EMEA/APAC. I always thought with the iOS7 encryption everything is encrypted but it looks like this is only the case with iOS8.

Geee 12y ago
iPhone's full-disk hardware encryption is not active after the device has booted and has been unlocked for the first time. There's second layer of software encryption for important data, which includes now much more (but not everything) in iOS8.
- astrange 12y ago
  That's not quite true; iOS doesn't use "full-disk encryption", but only file encryption. You can read about it under File Data Protection in http://images.apple.com/privacy/docs/iOS_Security_Guide_Sept_2014.pdf http://images.apple.com/privacy/docs/iOS_Security_Guide_Sept....
  - comex 12y ago
    Actually, the parent is correct - the PDF you linked suggests otherwise: > (NSFileProtectionNone): This class key is protected only with the UID, and is kept in Effaceable Storage. Since all the keys needed to decrypt files in this class are stored on the device, the encryption only affords the benefit of fast remote wipe. If a file is not assigned a Data Protection class, it is still stored in encrypted form (as is all data on an iOS device). but AFAIK, the way this is actually implemented is that the non-None file protection settings are an additional layer on top of full disk encryption. On my jailbroken iPhone 5s on iOS 7.1, the /var partition is mounted from /dev/disk0s1s2 - where the double partition is due to a CoreStorage block layer between the filesystem and the actual disk. If you dump some data /dev/rdisk0s1s2, you'll find a HFS+ filesystem with plenty of strings, but if you look at /dev/rdisk0 itself, they're nowhere to be found, i.e. the CoreStorage volume is encrypted. (There's probably a more direct way to determine this, but CoreStorage is closed source and undocumented, so meh...)
Tangokat 12y ago
Pretty interesting - this must have changed in iOS 8. At least according to Jonathan Zdziarski Apple previously had the ability to bypass the iPhone encryption for law enforcement if the phone was physically sent to Apple [1]. [1] http://www.zdziarski.com/blog/?p=2589 http://www.zdziarski.com/blog/?p=2589

Geee 12y ago

iPhone's full-disk hardware encryption is not active after the device has booted and has been unlocked for the first time. There's second layer of software encryption for important data, which includes now much more (but not everything) in iOS8.

astrange 12y ago
That's not quite true; iOS doesn't use "full-disk encryption", but only file encryption. You can read about it under File Data Protection in http://images.apple.com/privacy/docs/iOS_Security_Guide_Sept_2014.pdf http://images.apple.com/privacy/docs/iOS_Security_Guide_Sept....
- comex 12y ago
  Actually, the parent is correct - the PDF you linked suggests otherwise: > (NSFileProtectionNone): This class key is protected only with the UID, and is kept in Effaceable Storage. Since all the keys needed to decrypt files in this class are stored on the device, the encryption only affords the benefit of fast remote wipe. If a file is not assigned a Data Protection class, it is still stored in encrypted form (as is all data on an iOS device). but AFAIK, the way this is actually implemented is that the non-None file protection settings are an additional layer on top of full disk encryption. On my jailbroken iPhone 5s on iOS 7.1, the /var partition is mounted from /dev/disk0s1s2 - where the double partition is due to a CoreStorage block layer between the filesystem and the actual disk. If you dump some data /dev/rdisk0s1s2, you'll find a HFS+ filesystem with plenty of strings, but if you look at /dev/rdisk0 itself, they're nowhere to be found, i.e. the CoreStorage volume is encrypted. (There's probably a more direct way to determine this, but CoreStorage is closed source and undocumented, so meh...)

Tangokat 12y ago

Pretty interesting - this must have changed in iOS 8. At least according to Jonathan Zdziarski Apple previously had the ability to bypass the iPhone encryption for law enforcement if the phone was physically sent to Apple [1]. [1] http://www.zdziarski.com/blog/?p=2589 http://www.zdziarski.com/blog/?p=2589