On: Apple ordered to bypass auto-erase on San Bernadino shooter's iPhone

[nuxi7]

The court order refers to the need to load the custom OS image via DFU (device firmware upgrade) mode. I am not an iPhone user but I'm assuming that is exactly what the name implies. (some pre-boot recovery environment)

[lilyball → nuxi7]

It's been a few years since I looked at DFU, but my impression was that installing a new OS via DFU would have the side-effect of erasing the device.

[jon-wood → lilyball]

That's probably the case for you and I, but I'm sure with sufficient knowledge of how DFU works (for example by employing the engineers who designed it) you can persuade it to only rewrite particular blocks, leaving the data intact.

[muddi900 → lilyball]

In my jailbreak days, the DFU update did indeed wipe the device. I don't know how it works.

[bb88 → muddi900]

Did it actually write zeros to the flash memory or did it leave the data sitting around somewhere?

[leonatan → bb88]

The encryption key is deleted. All data can remain on the flash for years, but it's useless.

[mywittyname → leonatan]

But if you're planning on brute forcing the encryption key, this side-effect doesn't matter.

[muddi900 → mywittyname]

The key is not the password. If that were the case, the phone would have to re-encrypt everything everytime you change the pin or password. The password unlocks the key. And if you brute force the key itself, it might take decades, maybe centuries.

[pixelcloud → lilyball]

You could rewrite the bootloader and recovery firmware to really do anything. Resize some partitions and dual boot into a shell with some drivers for keyboard and wireless.

Basically jailbreak..