the capabilities of Magnet Forensics' digital forensics tools, after it claimed that connecting a phone to a specialized tool could allow access to its contents and the extraction of previously deleted data within minutes.
Hot Topics
Texas launches first test flights of electric flying taxi in the United States
900 novice swimmers compete in the Junior Swimming Championships
But the technical picture is more complex than this argument suggests. There are indeed professional tools capable of accessing data from locked or encrypted phones and extracting large amounts of information, but there is no reliable evidence to justify saying that a single tool can unlock any phone or recover all deleted data without exception.
What does Magnet actually do?
The tool most associated with this type of operation is Magnet Graykey, a platform dedicated to digital forensics of phones. The company says it allows access to data from modern iPhones and Android devices, including data that may be inaccessible through traditional methods, and then extracts and saves it for forensic analysis.
This does not mean that GrayKey is a universal key for all phones, as the success of the extraction is affected by the device model, the operating system version, its state at the time of confiscation, the protection measures activated, whether the phone is locked or unlocked, in addition to the type of extraction that the tool supports on that device.
Tests conducted by the U.S. Department of Homeland Security on a version of GrayKey indicate that the tool successfully obtained the data supported by the extraction techniques used in the test completely and accurately, but this result means the data supported in the test, not the recovery of everything from any phone.
Can you recover deleted files?
Herein lies the most important point of contention: deleting a photo or message from a phone does not necessarily mean that its traces disappear immediately from the storage unit. In some criminal extraction circumstances, databases, records, parts of files, or residual traces of data deleted by the user may be found, but the possibility of recovery varies greatly depending on the method of deletion, the file system, encryption, and whether the data has already been replaced.
Therefore, the phrase "recovers deleted data" needs to be qualified. Forensic analysis tools may be able to recover some deleted data or traces of it under certain circumstances, but they do not guarantee the recovery of everything that was deleted.
Does that mean that phone encryption is worthless?
The existence of advanced forensic tools does not mean that iPhone or Android encryption has become useless. What these companies do is exploit a range of methods, vulnerabilities, and mechanisms specific to each device and version, and then develop their capabilities with system updates.
Tags:
technology
