FORENSIC IMPLICATIONS OF APPLE'S “STOLEN DEVICE PROTECTION”

Summary from the TLDR InfoSec newsletter

The "Stolen Device Protection" feature was introduced in iOS 17.3 to prevent unauthorized access to sensitive iPhone data. This feature complicates data extraction for forensic experts by requiring biometric authentication to pair with a computer, limiting traditional extraction methods. Manual inspection may be the only viable forensic method for devices protected by this feature, but it has limitations and is not forensically sound.