iPhone disabled - connect to itunes

A friend has managed to lock her iPhone after failing at the pin code several time. From what I gather, it will no longer allow any attempts and the official process now is to erase it with a reinstall of iOS.
As far as I’m aware, there is no recent backup of this device, and there are potentially hundreds of photos of her kids and deceased husband, along with some notes. We logged into iCloud prior to the final failed unlock to see if there was anything we could do there, but it didn’t show up as a name we recognised (they have about 15 devices, mostly with generic names like “iPad”). The only online devices were identified as NOT being it anyway, so it appears wifi was off on the phone (and it has no mobile data access).
The phone is an iPhone 7 Plus. It’s very likely to be running an older iOS but as it’s locked, I can’t check.

So with the story over, does anyone have any experience with recovering data once an iPhone goes into this situation?

From my understanding, the encryption key has been erased from the device after several failed attempts and the account is functionally bricked.

Maybe something like Celebrite can help you? You need a digital forensics company for that kind of data retrieval. The problem is i think they could break in prior to the encryption key deletion event (which already happened, to my understanding).

Also, unsure if Apple actually has a copy if the key since they are the one actually managing the encryption keys. I doubt they will help you. You can always try to ask.

If all fails, if bounty is set high enough, i am sure some enterprising hacker can help you.

Doesn’t celebrite have problems pulling data from a phone in a BFU state?

The phone was configured to enter a security state, and this was triggered. It did what I’d hope it would do, if the phone were stolen. You can’t hammer in 10 codes in a minute, it doesn’t allow it.

is pretty much what apple will say.

It was a good idea to look into icloud. I say this as on a phone setup, apple do ‘help’ you enable icloud backups/photos and the other services.

If it was opted out of though, there’ll be no official recovery presented.

Taking the rest of your information into account, it might be possible to infer the phone was in a drawer for some time, passcode forgotten and, quite possibly - not on the icloud account that was thought.

I’d try to confirm the phone was on the icloud account you are led to believe - I’d suggest look in find my iphone, on icloud dot com - if it’s found there, and you know none of the backups you find on that account are of that device (/and/ the photos are not in the icloud photo library) - it either wasn’t in an icloud account, or at least not that one.

If it’s in ‘another’ icloud account - apple won’t tell you what that is, but may permit the owner to play a guessing game if some information about it is known (with a hint like a*b@d*n). I’d suggest that’s a best course to try but - it hinges on there being an icloud backup, somewhere.

best of luck

What version of ios. You might be able to slam on the lock screen with a bunch of 8’s or something and get in.

I would, hoowever, go to someone with o cellebrite and get that thing properly done.

The phone was being used almost daily. We suspect a child may have changed the code out of spite in the days prior.

I don’t know what iOS is has. It’s locked so I can’t look. All I know is it definitely has the feature where you have to unlock before USB works…

I think I’ll just have to tell her the data is gone unless she wants to store it for the next decade and wait to see if a hack comes along. I’m not suanyone private entites kn Australia have access to cellebrite, so I’m not sure that’s an option for us, even if cost wasn’t an issue.

I was mainly wondering if something like Cellebrite but more public existed since I’m pretty sure the iOS is older so probably more hackable.