This, of course, causes a major issue for forensic examiners. The primary issue with logical data acquisition is that certain data cannot be extracted for analysis, including deleted data, emails, cache files, and geo-locations. If the physical acquisition of a certain iOS model is not possible and jailbreaking is not feasible, a logical acquisition may suffice.

To bypass the encryption, an examiner would need to “jailbreak the device.” This is a risky approach since jailbreaking a device could lead to destroying current evidence and making the device unusable and inaccessible. Physical acquisition of certain iPhone models is not possible, due to Apple’s encryption. Physical images are bit for bit copies of a device, which includes deleted data. IOS devices, such as iPhones and iPads, also present imaging challenges. Some vendors claim to decrypt File Vault passwords, but the cost of this method is very high and may not provide the needed results. Mac computers also come with a built-in encryption feature called “File Vault.” If the user enables File Vault, examiners cannot image or access the contents of the computer until the encryption is bypassed, either with the user’s password or by extensive workarounds involving memory analysis to extract possible passwords. This allows a user to overwrite the computer’s free space 1 time, 7 times, or 35 times, making it impossible for forensic examiners to recover deleted data. Mac computers are known for having a secure delete function built into the system.

Our forensic professionals have extensive Apple experience and have provided expert testimony on a number of legal cases involving Apple devices. Kivu’s digital forensic professionals are seeing an ever-increasing number of Apple devices being used within organizations.

Find deleted files mac using blacklight