Lockdown method - Unlocking a passcode-protected iPhone
MOBILedit Forensic can connect to iPhones protected by passcodes. Many iPhone users use iTunes, especially for managing music and almost everyone has connected their iPhone to iTunes at least once. To get through the passcode, you need to access the computer that the locked iPhone was connected to and obtain the 'lockdown file' that iTunes creates automatically for any iPhone that connects to that PC.
Lockdown method does NOT unlock the phone (eg. the screen will stay locked even if successfull), but it enables our software to communicate with phone and extract data from it.
You can select the same extraction and analysis options as you would for an unlocked device, except for Screenshots.
You will find the lockdown files in the iTunes folder along with one of these file paths, depending on the operating system.
Windows Vista, 7, 8, 10
C:\ProgramData\Apple\Lockdown
Windows 2000/XP
C:\Documents and Settings\All Users\Application Data\Apple\Lockdown
Mac OS X
/var/db/lockdown
After finding these files transfer them to the computer with MOBILedit Forensic installed.
If the lockdown button does not appear, as shown below, stop Apple Mobile Device Services from running from within the Windows Task Manager.
Once you have the file and the Upload lockdown file button appears, click on the "Upload lockdown file".
Then select your lockdown file.
Click on Open and your iPhone will reconnect and will be unlocked.
The lockdown files method works in different ways for certain iOS versions.
for iOS 8 and lower - works mostly without any limitations (reboot doesn’t affect acceptance of lockdown files, lockdown file is unique to the device and can be used even after factory reset)
for iOS 9 - 11.2 - works without any significant limitations (except reboot explained above)
If your device is running iOS 9, or higher, if device was rebooted prior connecting, lockdown files are not accepted by device, until after first unlock with the passcode.
for iOS 11.3 and above - an expiration date of one week from the last computer connection was added for the lockdown file.
for iOS versions 11.4 and above - "restricted mode" was introduced, meaning that if the device is disconnected from the PC for more than an hour or, is connected to the PC it was never connected to, the user is forced to unlock the phone to connect. Otherwise, the PC will not recognize the device is connected to USB.
Restricted mode is turned on by default, however, the user can disable it in the settings.
for iOS versions 15 and above - the lockdown method may not work as the device will prompt the user for the passcode.