GCFA · Question #92
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him by the chief security officer of a cloth manufacturing company who suspects that one of the…
The correct answer is A. iPhone will be prevented from booting temporarily. Entering iPhone recovery mode halts the normal boot sequence and loads a minimal firmware state awaiting a restore command, but does not automatically destroy data.
Question
Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him by the chief security officer of a cloth manufacturing company who suspects that one of the employees is selling the design of the clothes outside the company. The security officer asked Adam to investigate the iPhone of the employee, as he suspects that there might be some sensitive information stored in his iPhone. On investigation Adam found out that the employee tries to destroy the evidence on his iPhone. He presses and holds the Home and Power buttons until the device is forced into recovery mode. Which of the following actions occurred when iPhone is set into recovery mode?
Options
- AiPhone will be prevented from booting temporarily.
- BThe file system will be destroyed.
- CNothing will happen.
- DData will be destroyed.
How the community answered
(32 responses)- A75% (24)
- B3% (1)
- C6% (2)
- D16% (5)
Why each option
Entering iPhone recovery mode halts the normal boot sequence and loads a minimal firmware state awaiting a restore command, but does not automatically destroy data.
Recovery mode prevents the iPhone from completing its normal boot by loading only the lowest-level firmware needed to communicate with a host computer over USB, displaying a connect-to-iTunes or connect-to-Finder screen. The device is suspended in this minimal state and cannot be used normally, effectively preventing the boot process temporarily. Data is not erased until a restore is explicitly initiated - so evidence remains intact while the device is held in recovery mode.
The file system is not destroyed by simply entering recovery mode - destruction occurs only if the user proceeds to perform a full restore operation while in that state.
Something clearly does happen when recovery mode is triggered - the device halts its normal boot sequence and enters a special low-level firmware state awaiting a USB connection.
Data is not automatically destroyed upon entering recovery mode - it is only wiped if a restore is deliberately executed from within recovery mode.
Concept tested: iPhone recovery mode behavior and forensic implications
Source: https://support.apple.com/en-us/HT201263
Topics
Community Discussion
No community discussion yet for this question.