Does anyone have the specs for this "Al Qaeda" phone handy? What model iPhone and what iOS version?https://twitter.com/josephfcox/status/1262385487299383299 …
-
Show this thread
-
Nevermind, found it. There were two phones: an iPhone 5 and 7 Plus. You can probably narrow down the iOS version based on the dates they were collected.
1 reply 1 retweet 6 likesShow this thread -
Here's a few notes: - checkm8 supports A5-A11 CPUs (iPhone 5) but most forensics vendors only support down to the A7 (5S) - Why? Probably because the iPhone 5 doesn't have a Secure Enclave and only supports up to iOS 10. - iPhone 7 Plus uses an A10 (Secure Enclave w/ TouchID)
2 replies 0 retweets 7 likesShow this thread -
Replying to @dguido
can checkm8 be used for a cold boot attack if the encryption keys are in memory?
1 reply 1 retweet 0 likes
Not an expert here, but I doubt it. 1st, iOS robustly evicts keys from memory after 48 hours and forces the user to re-auth via PIN code. 2nd, the priority during that 48hrs is keeping the device plugged in, usually for a court order to compel a fingerprint or face unlock.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.