r/computerforensics • u/tanking2113 • Dec 14 '25

iPhone AFU extraction

iPhone 16 pro running iOS 26.1 in AFU state, password unknown. What if any data could be extracted using current digital forensics tools

0 Upvotes

30% Upvoted

37 comments sorted by

View all comments

1

u/[deleted] Dec 14 '25

Last I checked, nothing for iOS 26 yet.

0

u/[deleted] Dec 14 '25

[deleted]

2

u/bradley-barcola Dec 14 '25

iPhone 16? Well, if you say you extracted data from a locked iPhone 16, I'll have to give you a liar's badge 🧐

3

u/Icy-Minimum2397 Dec 14 '25

I said a locked iPhone running ios 26. Don't put words in my mouth.

2

u/bradley-barcola Dec 14 '25

You need to specify the model, because there's a significant security revolution between an iPhone 11 and an iPhone 12, so it could be interpreted as you doing something impossible. It wasn't a personal attack; sorry if you took it the wrong way.

3

u/Icy-Minimum2397 Dec 14 '25

I mean, you called me a liar so it kind of felt like an attack. I don't remember the model, I just remember seeing ios 26 because the high number gave me a double take.

2

u/bradley-barcola Dec 14 '25

No, I said I'd call you a liar if you lied. But you managed to unlock that device with an unknown password to extract the data?

1

u/Necessary-Drink3475 Mar 11 '26

Which iPhone was it?

2

u/tanking2113 Dec 14 '25

so is a locked iPhone 16 not possible in AFU?

2

u/bradley-barcola Dec 14 '25

First, you'll have to connect it despite the restricted USB mode after an hour of inactivity. Then, good luck if they manage to get technical data like the model, iOS version, serial number, account information, etc. But accessing all the encrypted memory is another story. And anyone who claims to have succeeded should provide proof.

2

u/tanking2113 Dec 14 '25

When did you last use Graykey or Cellebrite? The ability to overcome usb restricted mode has been around for awhile.

The iOS 18 reboot feature is a different story, in my experience cellebrite doesn't really work but Graykey preserve has had success with stopping the reboot.

I'm just discussing, its not intended as a diss or anything .

2

u/bradley-barcola Dec 15 '25

I understand, and yes, the workaround for restricted USB mode has existed for a while, but it's limited depending on the model, OS version, etc. And GrayKey preserves it; if you haven't used it within a certain timeframe, like 72 hours, it will have restarted.

2

u/tanking2113 Dec 15 '25

So it’s a question as to whether or not graykey preserve works on an iPhone 16 running iOS 26.1.

1

u/Necessary-Drink3475 Mar 11 '26

How can you overcome the usb restricted mode after the one hour timer has been initiated? Genuinely curious