I recently lost my phone but have a very recent backup. I've enabled the remote wipe feature using iCloud but the device has not been online since being lost. It was low on battery power so likely died.

I'd like to verify that the device was set up to erase the data after X failed passcode attempts. However, I'm having a really hard time finding where in the backup that information would be stored. My suspicion/fear is that it might not be stored at all and thus I have no way to really ensure that it's relatively safe.

I've already enabled remote erase if it comes online, changed passwords for critical systems and banned the device from multiple services. And while I'm 99% sure I set it up to erase, I'd really like the peace of mind that the last 1% offers.

Much appreciated for any responses.

  • Where precisely is the backup of the phone located? – bmike Sep 7 '15 at 20:03
  • It's on my desktop hard drive. – Mike Taber Sep 8 '15 at 19:11

You'll not likely be able to establish security after the fact directly. The protection is a combination of the hardware in the iOS device and the setting of a passcode lock and not a preference stored on a filesystem - it's baked into the OS. The backed up data is not encrypted at rest in the same manner as iOS's security. The act of restoring the backup also overrides whatever passcode lock and settings you had, so that's not a good way to proceed.

What you can do is research the exact model of the phone and the version of iOS. Grab this pdf from Apple: http://www.apple.com/business/docs/iOS_Security_Guide.pdf

Starting on Page 9 it describes the conditions needed for data to be encrypted at rest. It also has valuable information about what types of data is readable if someone guesses your passcode.

What you can do is restore your backup to the same class of hardware and observe that with a passcode set, the data protection is enabled. Hopefully you have an A7 or later processor since the PIN entry is governed by hardware rate limiters to reduce the chance your PIN can be brute forced.

  • If restoring a backup overrides the passcode lock and settings, that would imply that data protection settings are somehow stored as part of the backup. Restoring to a newer version of hardware isn't likely to be a perfect test, but it's likely better than nothing. Especially if I can test it as having been overwritten with data protection and overwritten without it set. I'm not about to go out and buy a 2 year old phone to test it, since I'm going to buy a new one anyway. – Mike Taber Sep 8 '15 at 19:12
  • @MikeTaber my assumption is you are forced to choose a new passcode which then overwrites whatever setting was or was not restored. Perhaps someone has done the hard work to reverse engineer a backup. Perhaps in time, you will as the backup is under your control on your hard drive. – bmike Sep 8 '15 at 19:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .