Phone Forensics Rumors End

1.USB Debug mode must be turned on for root power?

Ans: (X)

Because the USB debugging only involves the phone in the normal mode of operation, can be issued through the computer ADB instructions, therefore, do not necessarily have to turn on the USB debugging, in order to root.

Because the FastBoot mode is a lower-level mode, you do not need to turn on USB debugging to perform the action of swiping the recovery ROM.

2. USB Debug mode must be turned on, in order to make graphics lock, password/pin, such as crack?

Ans: (X)

The principle is the same as above, since the root right does not require the USB debugging mode to open, and root right is omnipotent, therefore, all kinds of lock crack, naturally also with the USB debug mode open or not.

3. After successful, the ADB shell is unable to smooth su, so this means not really successful root?

Ans: (X)

As shown in the ADB shell in the Su, there will be an error message, but look carefully, both can enter the/data/system, and can browse the file under the path, natural can be removed or deleted, also need to care about SU success? Most funny, after removing Gesture.key, Mobile phone picture still have graphics lock, someone said, see, kill Gesture.key also useless, graphics lock still in??? In fact, this time, the graphics lock has failed, how to slip into the mobile phone desktop.

4. If the exhibit is an iphone 4s model, then the photo deletion will not be saved.

Ans: (X)

After study, if once JB's machine species, even if later iOS has been upgraded to iOS 9 above, with Dr Wondershare and other tools for data recovery, still may get deleted photos.

5.JTAG or Chip-off is the ultimate means, can not boot state, and invincible, no forensic analysis of the obstruction?

Ans: (X)

Even with JTAG or chip-off, you can make a full-machine image file, but do not forget, if you have to enable full-machine encryption (FDE), or to try to decrypt, not because the use of JTAG or Chip-off, you can see the whole machine to encrypt nothing.

6. Using the Business Forensics tool, you can bypass the idevice screen lock without having to press "trust" on the idevice.

Ans: (X)

You still have to unlock it, then press "Trust" on the desktop, or get plist files to bypass.

7. As long as the accomplice of the Pc/latop/mac to obtain plist, it is guaranteed to bypass the trust relationship smooth evidence

Ans: (X)

When there is an exception, if the offender is very cautious and often resets the idevice's right to privacy, the plist will not have any effect after the offender has been reset.

8. It is ensured that the idevice of his/her can be successfully unlocked by seeking to obtain the fingerprint of the suspect and making the mold.

Ans: (X)

If the idevice is in the boot state, the fingerprint produced by the sleeve may be fooled. But if the idevice has been turned off, after the boot, as shown, at this time the fingerprint identification is not work, even if it is guilty of using their own fingers to solve also useless, you must enter the password to line.

Phone Forensics Rumors End