The Unauthorized Guide to iPhone, iPad, and iPod Repair (2013)
Chapter 19. Before You Sell, Donate, or Recycle Your iDevice
In performing research for this book, I stopped at Nashville’s most popular used media store in search of second-hand iDevices. Boy, were my expectations exceeded! Within 20 minutes I left the store with both arms full of iPhones, iPod touches, and iPods.
I arrived home and immediately set about charging up the sundry Apple mobile hardware. You can’t imagine my surprise, however, when I powered on the iDevices and discovered that not a single one was erased.
At my fingertips I had so much personal information it made me feel guilty and uncomfortable using the devices. We are talking about
Previous owner’s name and contact information
Fully populated contact cards
Overflowing Photo Stream and Camera Roll pictures
SMS and iMessage text messages
Email messages
The list goes on. Needless to say, I was aghast, and I quickly performed a secure erase on all my “new” iDevices. (By the end of this chapter, you’ll know how to perform a secure erase as well.)
To be honest, I wasn’t sure who was more at fault for not erasing the devices prior to offering them for sale: the original owners or the secondhand shop staff.
In my opinion, understanding the hows and whys of iDevice reset and erasure is a core skill that every iDevice owner needs to have. The following are some of the common reasons why you might transfer ownership of your iDevice:
You plan to gift or donate your iDevice.
You plan to sell the device.
You plan to take the device in for repairs and don’t want techs viewing your data.
You plan to turn in your device for an upgrade.
Before you even seriously ponder erasing and resetting your iDevice, it should go without saying that you need to ensure that you have at least one known-good iTunes or iCloud backup at the ready should you change your mind after the erasure completes.
First I want to dispel some common myths regarding data deletion.
Is Deleted Stuff Actually Deleted?
Traditionally, data that has been deleted from a mechanical or solid-state hard drive is not actually deleted. Instead, the host operating system (iOS for our purposes) simply marks that data as having been deleted. Consequently, unless the operating system overwrites those blocks with fresh (or even pseudo-random) data, it is very possible to retrieve the blocks’ original contents.
Note: A Word About File Systems
In case you are interested, the file system that is used by iOS devices is Hierarchical File System, Extended (HFSX). HFSX is an extension of HFS+ that supports file and folder name case sensitivity.
Encryption, Your iDevice, and You
The good news is that as long as your iDevice runs at least iOS 5, all persistent data stored in flash memory is encrypted by default. Stated simply, encryption refers to the conversion of human-readable data to (for lack of a better word) jibberish.
iOS devices use the industry-standard Advanced Encryption Standard (AES) algorithm. You can consider an algorithm to be a complex mathematical formula. You take human-readable data, combine it with a unique, private key (essentially a really long number), and run it through the AES formulae. The end result is ciphertext.
The AES cryptographic engine is called hardware encryption by Apple because it consists of a system on a chip (SoC) located on the iDevice’s logic board (specifically in the address path between flash storage and RAM).
iPhones, iPads, and iPod touches contain two 256-bit AES keys that are stored locally on each device and are inaccessible to system users. One key, called the Group ID (GID) key, is shared by all iPhones, iPads, and iPod touches. The other key, called the User ID (UID) key, is unique for each iDevice.
These encryption keys are not used directly by iOS to encrypt and decrypt data. Instead, iOS uses the GID and UID to generate in-memory keys that actually perform the cryptographic work on the device.
Note: Practice Makes Perfect
If you want to practice your iOS jailbreaking and mobile device forensics skills, you can check out the SecurityLearn blog post “Extracting AES keys from iPhone” at http://is.gd/lzMDFD.
Now you can see, I’m sure, how important (and potentially vulnerable) those encryption/decryption keys are on your iDevice. Apple provides a related security technology called data protection in which you can protect your hardware encryption keys with a single passcode.
Follow these steps to enable data protection by configuring a passcode for your device:
1. Tap Settings, General, Passcode Lock.
2. Use the following steps to define a passcode.
a. Turn the passcode on
b. Create and confirm your passcode
c. Set passcode complexity options
3. Verify the configuration by scrolling down to the bottom of the screen and observing that the text Data Protection Is Enabled is visible (called out in Figure 19.1).
FIGURE 19.1 Use the passcode to protect your hardware encryption keys.
What’s cool about Apple’s hardware encryption is that you can simply nuke the encryption keys to render the entire disk unreadable. The key deletion occurs almost instantly, as well.
However, you’ll observe that when you perform a full erase of an iOS device, the process can take upwards of several hours. What’s going on here?
As it happens, iOS follows up the encryption key deletion with a full pass of device storage, overwriting the contents of each and every block. This process can take several minutes to several hours, depending upon the storage capacity of your iDevice.
The nutshell summary of all this information is that you can derive comfort in the fact that when you remove all data and settings from your iDevice, you are in fact securely erasing the device such that even a world-class forensics team would be very unlikely to recover data from that device.
In the following section, I show you how easy it is to securely erase your iDevice.
Preparing Your iDevice for Transfer—Local Method
Before you erase the contents of your iDevice, please ensure that
You made a complete backup by using either iTunes or iCloud.
iMessage is turned off. You want to avoid the possibility of the device’s next owner receiving your iMessage content, so you need to unlink the device from your Apple ID. You can do this by navigating to Settings, Messages, iMessage and sliding iMessage to Off.
You removed your SIM card from the iDevice. Leave the tray behind, however, so that the device’s next owner can insert his or her own SIM card to gain carrier network access.
Use the following steps to perform the erasure from your iDevice:
1. Navigate to Settings, General, Erase, and tap Erase All Content and Settings. As you can see in Figure 19.2, you are prompted to confirm your choice.
FIGURE 19.2 Initiating an erase on an iPhone.
2. When the device returns from the secure erasure and reboots, you’re prompted to set up the iDevice as a new device. At this point you are ready to transfer the iDevice to its new owner (see Figure 19.3).
FIGURE 19.3 A factory-fresh iPhone, ready for its new owner.
Preparing Your iDevice for Transfer–Remote Method
As you obviously know, your iDevice contains sensitive data that you do not want to fall into the wrong (that is to say, anybody else’s) hands. What recourse do you have if, heaven forbid, a malicious individual were to steal your beloved iDevice?
Alternatively, what if you sell your iDevice and realize afterward that you forgot to erase all content and settings?
The good news is that as long as the following items are true, you can perform a remote wipe on your iDevice:
The iDevice is powered on.
The iDevice is reachable via carrier network or Wi-Fi.
The iDevice hasn’t had the Find My iPhone/Find My iPad/Find My iPod iCloud service disabled.
Note: Find My iPhone No Longer Works
After you remotely wipe an iDevice, you lose the ability to determine the device’s location by using Find My iPhone.
To perform a remote wipe via a web browser and the iCloud website, use the following steps:
1. Open a Web browser, navigate to icloud.com and log into the service with your Apple ID and password.
2. From within iCloud, click Find My iPhone (wonky name, I realize, because you can locate iPads and iPod touches here as well).
3. Open the Devices menu and select the target iDevice.
4. In the device’s Info window, click Erase iPhone, Erase iPad, or Erase iPod, depending upon the device (see Figure 19.4).
FIGURE 19.4 Remotely wiping an iDevice by using iCloud.
5. Enter your Apple ID to confirm your decision. The iDevice is then securely erased immediately.
Corporate Solutions
Apple has historically not been known for its enterprise friendliness. For instance, I still have nightmares in which I flash back to my past experiences in integrating Apple’s Open Directory with Microsoft’s Active Directory.
Nevertheless, many information technology (IT) departments realize the value, not to mention the overarching popularity, of iOS devices, and as such IT decision makers increasingly find themselves faced with distributing, managing, and supporting iPhones in their enterprise networks. Many of these networks are Windows-only, which poses additional challenges.
A detailed discussion of enterprise-level remote iDevice wiping is far beyond the scope of this volume. However, I thought it instructive to at least let you know what primary options are out there in the arena of remote device wipes.
Microsoft shops that need to support iPhones can use Microsoft Exchange Server (http://is.gd/75FEnc) and Microsoft ActiveSync to enroll, manage, and perform remote wipes on iPhones. For those who don’t know, Exchange Server is Microsoft’s enterprise messaging platform; it offers corporate email, shared calendaring, task lists, and deep integration with other collaboration platforms such as Voice over IP (VoIP) telephony and SharePoint web portals.
ActiveSync is a long-standing Microsoft proprietary protocol that enables mobile phones to synchronize content with Exchange Server.
If a business is fortunate enough to have deployed at least one Apple OS X Server (http://is.gd/5mLDZt) box in its environment then IT administrators can leverage the Profile Manager tool to perform remote wipes on enrolled iOS devices. Profile Manager is a web-based management application that supports full control of any Apple hardware in use within the organization. A screenshot from the Profile Manager interface is shown in Figure 19.5.
FIGURE 19.5 You can use Profile Manager to perform a remote wipe of a managed iDevice.
Disposal and Associated Environmental Concerns
iDevices, like many types of portable electronic equipment, contains glass and heavy metals that are destructive to the environment. Actually, if some of these metals—such as cadmium, lead, nickel, mercury, manganese, lithium, zinc, arsenic, antimony, beryllium, and copper—leach into ground water, they can produce sickness and death in plants, animals, and humans.
The Lithium-Ion (Li-ion) batteries in your iDevices present another environmental hazard. Although these units do not contain heavy metals, they do indeed pose an environmental fire hazard.
In all seriousness, you need to take iDevice disposal seriously and not simply toss your broken or unwanted hardware into the trash.
You should know that Apple itself instituted an incentive program to encourage you to turn in your unwanted mobile hardware to either your nearest Apple Store or online at http://is.gd/rclJAK.
Be aware of the following facts concerning the Apple iPod and Mobile Phone Recycling Program:
Apple provides environmentally friendly disposal of any manufacturer’s mobile phones.
If you recycle your iPod then Apple gives you a 10 percent discount toward the purchase of another iPod.
If you recycle your iPhone then you could be given an Apple Gift Card worth the old phone’s fair market value. (You can read more information at http://is.gd/j4jKG8.)