How to bypass iOS lock screen protection

If a passcode is unknown but you have an access to the user’s PC or Mac, use it to search for Lockdown.plist file and then copy it to the root directory of your forensic USB flash drive. Please note that the .plist file must come from the computer, which the specific iPhone was synced with.

Where to search:

Windows 98/ME/2000/XP:

Documents and Settings\All Users\Application Data\Apple\Lockdown\

Windows Vista/7:

Users\<User Name>\AppData\Roaming\Apple Computer\Lockdown\

Mac OS X:

X (VolumeName)\Users\<User Name>\Library\Lockdown\

How it works:

  • Once you attempt to analyze a locked device in Oxygen Forensic® Suite you are asked for an unlock code.
  • There is a choice of two options: enter the passcode manually or use the lockdown file.

bypassioslockscreen

  • If a passcode is unknown and the file is copied, insert the USB drive in the USB port of your forensic station where Oxygen Forensic Suite is installed and browse for it in Oxygen Forensic Extractor.

applelockdownfile

  •  The software will ask to replug the device and press the Connect button again:

bypassiphonelockscreen

  • After pressing the Connect button you can then proceed with data extraction:

connectlockediphone

Important Notes:

  • If the device is rebooted after the lockdown file is created (not copied) there will be limited extraction. The lockdown file will no longer be compatible and only media files will be extracted
  • If jailbroken devices are rebooted after the lockdown file is created, only passwords will not be extractable. All other data will be acquired.
  • Lockdown file and must be no older than 30 days.

 

 

This entry was posted in Articles and tagged , , , , . Bookmark the permalink.

Comments are closed.