[sidoshi]

How do you Image an iphone device?

[einsteinx2]

I assume you can desolder the flash chip and directly dump its contents. Not trivial, but not too difficult for someone with the right skills.

[kalleboo]

That won't give you the encryption keys, which are stored in the Secure Enclave.

[aziaziazi]

Isn’t the Secure Enclave another separate flash chip?

[wkat4242]

Yes but with the controller built in and hardware hardening.

They are designed precisely to prevent this kind of attack.

I bet most of the exploits used by these boxes have nothing to do with the secure element but just bypass security using exploits in standard system or USB code. Most phones will be captured with the OS running but just the UI locked, with all encrypted volumes already mounted.

[neuralRiot]

If they can access the iCloud account then the phone can be backed up remotely then read the backup.

[wkat4242]

True but only if the user actually uses iCloud backup of course. I never did when I had an iPhone, for that reason, I don't want all my personal stuff in the cloud.

But this is not how cellebrite boxes work anyway. They focus on the device.

[kalleboo]

Assuming the user hasn't enabled end-to-end encrypted backups (which is an option, not the default)

[filoleg]

Yeah, I had the same question. Because the grandparent comment explanation felt very much like the “…and then draw the rest of the owl” joke.