LOCKED IOS DEVICE: DATA AVAILABILITY ON BEFORE FIRST UNLOCK (BFU) STATES EXTRACTION

Abstract

Translate Article

Globally, Apple iOS has 17.3% of smartphone market share, which aligns with the findings from Cellebrite in 2024.It highlights iOS devices as dominant digital evidence in digital forensics investigations.However, accessing the data in locked iOS devices remains a significant challenge due to limited data accessibility.This study evaluates the effectiveness of Before First Unlock (BFU) extraction in recovering user data from locked devices.We compare data availability and integrity between BFU and Full File System (FFS) extractions using mobile forensics tools and file hash comparison.The analysis revealed a 63.48% match rate (338,062 of 532,509 files) between BFU and FFS extractions, indicating some data loss in BFU.While some documents were recoverable, critical application data was inaccessible.This highlights the limitations of BFU extraction in retrieving complete datasets from locked iOS devices.However, the recovered data with verified integrity remains valuable for forensic investigations.