#5631394 Supervisors

Final version, rev. 2 Since the introduction of the iPhone 3GS Apple o↵ers a new form of encryption scheme called Data Protection. In this research project a relation has been made on how Data Protection has consequences for a forensic investigation. The report holds a literature study that elaborates on what has been done in this field before as well as to what the latest forensic methods are. A practical attack as presented by Bédrune and Sigwald[4] has been performed on a first generation iPad equipped with version 4.3.3 of iOS, which currently is the latest version. Using this implementation it is relatively easy to circumvent iOS Data Protection using a bootrom exploit. With these technical abilities forensic possibilities are identified. iOS devices are hardened against human attack vectors, not against a brute forcing computer. Data Protection has successfully been broken which allows for full forensic in-vestigation. The diculty is in presenting this data to court, as the operating system on iDevices is prone to changes which introduce inconsistencies if the audit is per-formed by a di↵erent party. Traditional forensics simply does not apply to mobile devices and requires an alternative investigation path. Acknowledgements I would like to thank my supervisors Coen Steenbeek, Marco Veen and Derk Wieringa from Deloitte Risk Services for their time, e↵ort and insight put into this research project. Additionally I would like to thank the colleagues at Risk Services for the warm stay, as well as the opportunity to use hardware and licensed software available at Deloitte