c_mulholland@nym.hush.com

There is a computer specialist on the witness stand of the MJ manslaughter
trial of Dr. Conrad Murray.

The specialist recovered files from Dr. Murray's iPhone 3G? and is
testifying on it's contents.

Which begs the question: if you don't want screen shots of your iPhone and
other contents recovered by a computer specialist is there any way to
guarantee the iPhone is wiped clean?

If one selects | Settings | Reset | and delete all content would that do the
trick or will content be left hanging around for someone to recover if they
have the resources such as the FBI or the DEA?

Please don't comment on Dr. Murray guilty and/or innocent. That is for
another thread.

TIA.

nospam

In article <oi4p87143r7sa952pm1281m2tk8alks000@4ax.com>,
<c_mulholland@nym.hush.com> wrote:

> There is a computer specialist on the witness stand of the MJ manslaughter
> trial of Dr. Conrad Murray.
>
> The specialist recovered files from Dr. Murray's iPhone 3G? and is
> testifying on it's contents.
>
> Which begs the question: if you don't want screen shots of your iPhone and
> other contents recovered by a computer specialist is there any way to
> guarantee the iPhone is wiped clean?

the only guarantee is to physically destroy so that there's literally
nothing left to analyze.

> If one selects | Settings | Reset | and delete all content would that do the
> trick or will content be left hanging around for someone to recover if they
> have the resources such as the FBI or the DEA?

all that does is obliterate the encryption key. the encrypted data is
still there on the device and given enough time and money, it can be
extracted and cracked. if the user had a 4 digit passcode, it probably
won't take too long.

Jon Ribbens

On 2011-10-05, c_mulholland@nym.hush.com <c_mulholland@nym.hush.com> wrote:
> Which begs the question: if you don't want screen shots of your iPhone and
> other contents recovered by a computer specialist is there any way to
> guarantee the iPhone is wiped clean?
>
> If one selects | Settings | Reset | and delete all content would that do the
> trick or will content be left hanging around for someone to recover if they
> have the resources such as the FBI or the DEA?

If Apple have done the job right, then nobody could recover the data
after you've done that.

Doug Anderson

c_mulholland@nym.hush.com writes:

> There is a computer specialist on the witness stand of the MJ manslaughter
> trial of Dr. Conrad Murray.
>
> The specialist recovered files from Dr. Murray's iPhone 3G? and is
> testifying on it's contents.
>
> Which begs the question: if you don't want screen shots of your iPhone and
> other contents recovered by a computer specialist is there any way to
> guarantee the iPhone is wiped clean?

Is there any reason to think the "specialist" did anything other than
look at files on the phone? That is, was there any actual "recovery"
involved?

By the way (not that I'm going to convince anyone), that isn't what
"beg the question" actually means.

Jon Ribbens

On 2011-10-05, nospam <nospam@nospam.invalid> wrote:
> all that does is obliterate the encryption key. the encrypted data is
> still there on the device and given enough time and money, it can be
> extracted and cracked.

For some definition of "enough time" including "millions of years".

> if the user had a 4 digit passcode, it probably won't take too long.

No, that's not how it works. The data is encrypted with a 256-bit
key no matter whether you have a passcode or not.

nospam

In article <slrnj8p7or.398.jon+usenet@snowy.squish.net>, Jon Ribbens
<jon+usenet@unequivocal.co.uk> wrote:

> > all that does is obliterate the encryption key. the encrypted data is
> > still there on the device and given enough time and money, it can be
> > extracted and cracked.
>
> For some definition of "enough time" including "millions of years".

actually, less than an hour.

> > if the user had a 4 digit passcode, it probably won't take too long.
>
> No, that's not how it works. The data is encrypted with a 256-bit
> key no matter whether you have a passcode or not.

<http://venturebeat.com/2011/05/25/russians-crack-apples-ios-encryption/>

To do the decryption, ElcomSoft¹s researchers needed to get hold of
various keys on the device. They developed a toolkit to extract these
keys and also to guess the passcode using a brute-force method. Since
passcodes are only 4 digits long, breaking them takes 20 to 40
minutes on an iPhone 4.

Jon Ribbens

On 2011-10-05, Doug Anderson <ethelthelogremovethis@gmail.com> wrote:
> c_mulholland@nym.hush.com writes:
>> The specialist recovered files from Dr. Murray's iPhone 3G? and is
>> testifying on it's contents.
>>
>> Which begs the question: if you don't want screen shots of your iPhone and
>> other contents recovered by a computer specialist is there any way to
>> guarantee the iPhone is wiped clean?
>
> By the way (not that I'm going to convince anyone), that isn't what
> "beg the question" actually means.

It isn't what it *used* to mean. It is one of the meanings now.

Jon Ribbens

On 2011-10-05, nospam <nospam@nospam.invalid> wrote:
> In article <slrnj8p7or.398.jon+usenet@snowy.squish.net>, Jon Ribbens
><jon+usenet@unequivocal.co.uk> wrote:
>> No, that's not how it works. The data is encrypted with a 256-bit
>> key no matter whether you have a passcode or not.
>
><http://venturebeat.com/2011/05/25/russians-crack-apples-ios-encryption/>
>
> To do the decryption, ElcomSoft¹s researchers needed to get hold of
> various keys on the device. They developed a toolkit to extract these
> keys and also to guess the passcode using a brute-force method. Since
> passcodes are only 4 digits long, breaking them takes 20 to 40
> minutes on an iPhone 4.

That's talking about an iPhone that *hasn't been wiped*.

If you have physical possession of someone's phone, and it hasn't
been wiped, then yes of course you can retrieve the data - and that
goes for any phone, not just iPhones.

nospam

In article <slrnj8p8l4.398.jon+usenet@snowy.squish.net>, Jon Ribbens
<jon+usenet@unequivocal.co.uk> wrote:

> If you have physical possession of someone's phone, and it hasn't
> been wiped, then yes of course you can retrieve the data - and that
> goes for any phone, not just iPhones.

wiping an iphone doesn't erase the data, it only erases the keys to
decrypt the data, which can be hacked with a variety of techniques.

the original iphone and iphone 3g did not have hardware encryption so
when you wiped the device it really did overwrite (and took a long,
long time).

Jon Ribbens

On 2011-10-05, nospam <nospam@nospam.invalid> wrote:
> In article <slrnj8p8l4.398.jon+usenet@snowy.squish.net>, Jon Ribbens
><jon+usenet@unequivocal.co.uk> wrote:
>> If you have physical possession of someone's phone, and it hasn't
>> been wiped, then yes of course you can retrieve the data - and that
>> goes for any phone, not just iPhones.
>
> wiping an iphone doesn't erase the data, it only erases the keys to
> decrypt the data,

Yes, that is true.

> which can be hacked with a variety of techniques.

If there's a "variety of techniques", perhaps you would be so good as
to describe just one of those techniques for us.

> the original iphone and iphone 3g did not have hardware encryption so
> when you wiped the device it really did overwrite (and took a long,
> long time).

Indeed.