Forensic extraction from damaged iPhones
With a damaged iPhone, the condition of the original hardware determines whether a forensic extraction becomes possible at all. The data is encrypted, and the key exists only in the interplay of the original components.
Technically reviewed by Jan Petermann, Founder & Managing Director, smartmodPublished on
Why hardware condition and data access are linked
iPhones encrypt all user data. The keys are managed by the Secure Enclave, an isolated security area within the main processor. The underlying key material does not leave this area and is bound to exactly this processor.
For forensics this means: the data only becomes readable again via the functioning original system. An iPhone that no longer boots or does not communicate is therefore first of all a hardware problem – not a problem of the extraction system.
Typical damage
Liquid and corrosion
Short circuits and progressing corrosion, frequently under shielding plates and in the area of the connectors.
Mechanical damage
On many newer models the logic board has a two-layer design. Drops or bending can interrupt the connection between the layers without much being visible from the outside.
Fire and heat
Damaged components and solder joints; what matters is the condition of the processor and the flash memory.
Faults in the power supply
Short circuits on supply lines or defective power management components – the device does not boot.
Defective interfaces
Lightning or USB-C port or the associated interface components: the device may run, but is not recognised by the extraction system.
Why a logic board swap does not solve the data problem
If the damaged logic board is replaced with a working replacement board, an iPhone does boot again – but with a different processor, a different Secure Enclave and different memory. This device no longer has anything to do with the original data.
For a forensic extraction a board swap is therefore worthless. What matters is that the original components relevant to the data and to cryptography are preserved.
Preserving the relevant original components
Relevant to the data are above all the main processor with the Secure Enclave and the flash memory. These components must be preserved and operated in their original assembly.
If the original board can no longer be saved, in severe cases these components – depending on the model together with further parts coupled to the system – can be transferred to an intact carrier board of the same model. This requires high precision in BGA rework and is not possible in every case.
Board-level reconstruction
Board-level reconstruction starts at the original board: diagnosis under the microscope, measurement of the supply voltages, localisation of short circuits, repair of interrupted traces and replacement of defective components that are not relevant to the data. The goal is not a device fit for everyday use, but a state in which the iPhone boots and communicates again.
Restoring power and data communication
Power supply
The device must be supplied with stable power and complete the boot process fully.
Data communication
The connection via Lightning or USB-C must work so that the extraction system recognises the device.
Stability
The device must run reliably for the duration of the extraction – with large volumes of data possibly for hours.
Further functions
Whether, beyond that, a working display is required, for example, depends on the intended extraction method.
Handover to the forensic extraction workflow
After the reconstruction the device is passed on to the extraction workflow – in the client’s laboratory with the client’s systems or, by arrangement, in the reconstructing laboratory. The hardware interventions carried out are documented on a per-case basis and handed over with the device.
Limits regarding passcode and encryption
A successful reconstruction does not automatically mean access to the data. If the passcode is known, the device decrypts its data itself after booting. Without a known passcode, access may nevertheless be possible depending on the model, iOS version, device condition and the available forensic procedures; whether this applies to a specific device can only be determined after examination.
No speculative entry attempts
Initial technical assessment
A few details are sufficient for an initial assessment: model, damage pattern, current condition – response to power, display, recognition by a computer or extraction system –, measures taken so far and, where available, photos of the device or of the opened board.
Until the assessment
Answered briefly.
Can an iPhone with a broken logic board still be forensically extracted?
Possibly, yes. What matters is whether the processor and flash memory are undamaged. If they are intact, interrupted connections can in some cases be repaired at board level, or the original components are transferred to an intact carrier board of the same model. A reliable statement is only possible after a diagnosis.
Why does repairing a damaged iPhone with a new logic board not help?
Because the data is bound to the processor and Secure Enclave of the original board. An iPhone with a new logic board does boot, but has no access to the original data.
Related reading.
Forensic Device Recovery
Board-level reconstruction of damaged mobile devices for forensic extraction.
Learn moreChip-off in smartphone forensics
Why desoldering the memory rarely helps with encrypted devices.
Learn moreForensic extraction from a damaged smartphone
Damage patterns, methods and what the laboratory needs for an assessment.
Learn moreWe assess whether the device can be reconstructed.
For an initial technical assessment, a few details about the device and the damage pattern are sufficient.
Wasserweg 8–10 · 60594 Frankfurt am Main