Hacker News Reader

Comment by ImprovedSilence | Hacker News Reader

I've actually used that device before. It's fairly common in law enforcement and inteligence agencies, and it will take everything. Including passwords/deleted info. There is no reason for using it on a traffic stop though, that's just straight up invasion of privacy and would piss me off to no end. It's use is (and should be) for the more criminal/forensic cases.

View on HN

And it doesn't work on all devices out there, and doesn't fully collect the devices it does work with.

Most forensics labs have multiple tools such as this, and still have issues fully collecting devices.

I wonder if that device utilizes some form of "law enforcement backdoor API", a phone analog of the "lawful intercept" in networking. Because frankly I don't understand how else it could retrieve previously deleted data from the phone.

If you look at apps like BitPim, you'll see there's a standard protocol that many phones use for syncing. That protocol gives access to far more data than you might expect. If you have USB Debugging enabled in Android, the level of access is probably similar, and even if not, they can read your entire micro SD card via USB mass storage. I don't know enough about Android syncing to say whether it's possible to access contact data via USB when the phone is not in debugging mode, or whether there's a way to activate mass storage mode or Bluetooth transfers without unlocking the phone.

Perhaps you could answer a question. If the phone screen is locked will this device still gather data? I assume it will.

iTunes will happily sync with your iDevice when its screen is locked, so locking is clearly no barrier.

If you plug your iOS device into another computer it won't connect to iTunes until you unlock the device. Whether that is enforced by the phone or iTunes I don't know.

Reply on news.ycombinator.com