3 ms·

iPhone's full-disk hardware encryption is not active after the device has booted and has been unlocked for the first time. There's second layer of software encr

• astrange 12y ago
  That's not quite true; iOS doesn't use "full-disk encryption", but only file encryption. You can read about it under File Data Protection in http://images.apple.com/privacy/docs/iOS_Security_Guide_Sept_2014.pdf http://images.apple.com/privacy/docs/iOS_Security_Guide_Sept....
  • comex 12y ago
    Actually, the parent is correct - the PDF you linked suggests otherwise: > (NSFileProtectionNone): This class key is protected only with the UID, and is kept in Effaceable Storage. Since all the keys needed to decrypt files in this class are stored on the device, the encryption only affords the benefit of fast remote wipe. If a file is not assigned a Data Protection class, it is still stored in encrypted form (as is all data on an iOS device). but AFAIK, the way this is actually implemented is that the non-None file protection settings are an additional layer on top of full disk encryption. On my jailbroken iPhone 5s on iOS 7.1, the /var partition is mounted from /dev/disk0s1s2 - where the double partition is due to a CoreStorage block layer between the filesystem and the actual disk. If you dump some data /dev/rdisk0s1s2, you'll find a HFS+ filesystem with plenty of strings, but if you look at /dev/rdisk0 itself, they're nowhere to be found, i.e. the CoreStorage volume is encrypted. (There's probably a more direct way to determine this, but CoreStorage is closed source and undocumented, so meh...)