Since October 2007, the process of Jailbreaking has been out in the universe, allowing for deeper access to the mysterious Apple file system.  In the beginning, this technique was frowned on in the digital forensics field because of the potential risk to the device evidence.  Jailbreaking was also a violation of the Digital Millennium Copyright Act (DMCA) and voided the warranty by Apple.  In July of 2010, the courts ruled that the protection Apple used that made Jailbreaking a device legal and not a violation of the DMCA.  This ruling opened the digital forensic world to new techniques and new levels of access, but at what cost?

What is the advantage of Jailbreaking?

Jailbreaking allows you to circumvent the protection that Apple places on the file system of the device.  Depending on the firmware on the device, jailbreaking can make a huge impact on your case.  In earlier firmware versions, user data did not always primarily exist in the protected area, so the value of the jailbreak compared to the risk on the device was not always weighted in the favor of the jailbreaking technique.  As times and locations of data have changed, so has the value of the Jailbreak.     

Each tool will have different methods for implementation of the Jailbreak options in digital forensics.  For the E3 Forensic Platform, a package manager, Cydia, is installed on the device.  Cydia is used for the installation of software not authorized by Apple.  Cydia is then used to be able to install the OpenSSH package for the successful acquisition of the jailbroken devices. This imaging option using the checkra1n jailbreak allows access to new iOS devices physically and the user data that is now residing in the file system.

You can see the Checkra1n method utilized in the E3 Platform. Electronic Evidence Examiner allows acquiring the iOS devices jailbroken by multiple exploits, for example, unc0ver, Checkra1n, Chimera and so on. The choice of the exploit depends on the iOS version.

The data that can be captured for your case from a jailbroken device is much greater than what can be captured from a basic logical examination. The following list is data that can be accessed with an acquisition of a Jailbroken device. Some of this data might also be available with a logical acquisition, but not all of the data.