A research of digital forensic method based on the Checkm8 heap vulnerability

Locked Ios Device: Data Availability on Before First Unlock (Bfu) States Extraction

“…The BFU extraction was using Cellebrite UFED Premium capability and did not utilize the checkm8 exploit, which using physical extraction method from DFU mode. While the checkm8 could be combined with tools like checkra1n and libmobiledevice, forensic investigator can gain access to semi-encrypted data on certain iPhone models through jailbreak, even when the device is locked [17]. However, checkm8 method has limitations in device and iOS version compatibility, we aimed to explore the potential of BFU data extraction capabilities for future forensic applications.…”