Locked iPhone, Cloud Backup, and a Six-Digit Passcode
A 32-year-old suspect is arrested for fraud. Officers seize an iPhone 12 running iOS 16.5 from his person. The phone is locked with a six-digit passcode, connected to a cellular network, and displaying a lock-screen notification from a banking app. The suspect refuses to provide the passcode. The warrant authorizes seizure and search of the phone and any cloud backups associated with the device. The phone battery is at 18%. The officer on scene wants to press the home button and try common passcodes before the phone locks further. The lab has a Cellebrite UFED and a Faraday bag but no GrayKey. The suspect's iCloud account is linked to the phone; the account credentials are unknown.
1. What immediate preservation steps should be taken, and what mistakes should be avoided?
Read the worked answer
Reasoning: The phone is powered on, networked, and locked. The immediate risk is remote wipe, account changes, or lock-screen state changes. The safest first step is to place the phone in a Faraday bag to block cellular, Wi-Fi, and Bluetooth signals without powering it off. Powering off can move the device to a colder state and may make some extraction methods harder; it can also lose notification content or session state.
The officer should not repeatedly press the home button or try common passcodes. Failed attempts can increase lockout delays and, depending on settings, may trigger erasure. The examiner should photograph the lock screen, record the time and battery level, and keep the device charged with an external power source if appropriate. The device should not be connected to an unknown computer or network, updated, or jailbroken.
A Faraday bag is preferable to airplane mode because changing settings alters state. If no Faraday bag is available, isolate the phone in a shielded container and document the delay. Legal authority should be confirmed before any passcode bypass attempt.
2. How should the examiner approach the cloud backup and the locked device under the warrant?
Read the worked answer
Reasoning: The warrant covers the phone and associated cloud backups, so the examiner should pursue both paths in parallel. For iCloud, the examiner should preserve the account and request backups and account records through the provider's legal process. The examiner should not rely on the suspect's unknown credentials or attempt unauthorized account access. Cloud data may be stored outside the jurisdiction, so the prosecutor may need a mutual legal assistance request.
For the device, the examiner should first attempt a lawful extraction with available tools. A Cellebrite UFED may support some logical or advanced extractions depending on iOS version, lock state, and enabled services. The examiner should document tool versions, attempts, and failures. If the passcode cannot be bypassed, the device should be preserved for a lab with advanced capabilities rather than subjected to risky brute force.
Cloud and device evidence should be kept separate in the report, with hashes and chain of custody for each. The examiner should explain any gap between what the warrant authorized and what could technically be obtained.
3. If the passcode cannot be bypassed, what alternative evidence sources and arguments remain?
Read the worked answer
Reasoning: A locked phone is not the only source of evidence. The examiner should identify corroborating sources: iCloud backups, iTunes or Finder backups on a computer, synced email and photos, banking-app server logs, carrier call detail records, cell-site data, ISP logs, and account recovery records. The lock-screen notification itself may provide a timestamp and app name even if the content is not accessible.
The examiner can also look for linked devices, such as a tablet or laptop, that may hold messages or backups. Witness statements and financial records may establish the fraud independently. If the device remains inaccessible, the report should state the limitation clearly and explain what was attempted.
The argument to the prosecutor is not 'the phone is unavailable, so the case fails.' It is 'the phone is preserved, the cloud and third-party records are available, and the inaccessible device should be held for future capability or lawful passcode cooperation.' The examiner should avoid overstating what a lock screen or notification proves.