0

First I'd like to ask is flash memory used in an iPhone? If yes then please answer my next question.

Flash memory uses wear levelling (changing the physical location on the memory of a logical location) to maximise lifetime. Most flash has some "spare" space that is unreported to allow it to maintain the reported space when an area wears out. This means that there may well be some small amounts of memory that probably holds some unknown data even when the phone is reporting as full. However, it would be arbitrary data and I would expect it would require forensic tools to recover it.

When you reset an iPhone the memory gets encrypted and the keys are deleted. But is the data in the worn out area also encrypted, and does the app shredit and other file shredders also overwrite the worn out area?

Anders
  • 64,406
  • 24
  • 178
  • 215
  • 1
    "When you reset an iPhone the memory gets encrypted" - unlikely, what would be the point of that compared to just erasing it? More likely the memory was already encrypted. – user253751 Nov 07 '16 at 20:59

2 Answers2

1

First I'd like to ask is flash memory used in an iPhone?

Yes.

When you reset an iPhone the memory gets encrypted and the keys are deleted. But is the data in the worn out area also encrypted…?

Data in an iPhone's flash memory is always encrypted. When the phone is reset -- either through a software restore, or using the "Erase all content and settings" option in Settings -- the encryption keys are overwritten. This makes it impossible to decrypt any of the old data, whether it was stored in an active part of flash memory or not.

Apple's white paper iOS Security explains the device's hardware security in more detail. It's worth reading.

0
  1. Yes, flash memory is used

  2. If you had encryption enabled when the data was written to the worn out area, then it will still be encypted. The opposite is also true. See also: https://ssd.eff.org/en/module/how-encrypt-your-iphone

  3. For the exact operations of file shredder apps you would need to ask the authors, but if you want to understand in detail the mechanics of iPhone encryption, this is a good (technical) guide covering older versions of iOS: http://esec-lab.sogeti.com/posts/2012/06/28/low-level-ios-forensics.html

Colin Pickard
  • 1,800
  • 2
  • 11
  • 14
  • 1
    I'd like to add that if you had encryption enabled when data was written to the worn out area, it does not matter if that area is shredded or not since the data is pointless without the encryption key. – Anders Nov 03 '16 at 15:00
  • @ColinPickard During factory reset if all the data is encrypted and if it is then is the worn out data also encrypted. –  Nov 06 '16 at 08:55