Locked iPhone forensics for a life insurance claim, 2.4M TL to the family in 14 days
After the death of a 17-year-old in a motorcycle accident, a 2.4M TL life insurance claim process was opened. The insurance adjuster requested the iPhone's contents to distinguish accident, suicide or intentional death. The device had been on a muddy road at the scene for 11 hours, the screen was cracked, Face ID was unusable, Activation Lock was active, and because the owner had died the PIN was unknown. The DSET mobile forensics team prepared an ISO 27037 and ISO 27042 compliant insurance technical expert opinion in 14 days, and the compensation was paid to the family within 48 hours.
01 The Challenge
The insurance policy foresaw 2.4M TL of compensation in the event of loss of life, but a policy clause did not pay compensation in the case of suicide or intent. The insurance adjuster required the digital activity in the 24 hours before death. The device had been on a muddy road at the scene for 11 hours, water and soil had gotten inside, the Lightning port had rusted, and the screen was cracked, the Face ID hardware not working. Activation Lock was active, the family did not know the owner's Apple ID password, and the owner had not added a Digital Legacy Contact. The Apple Legal Process Guidelines route took 60 to 90 days, while the insurance claim objection period was 30 days. A wrong intervention could permanently erase the encryption keys in Effaceable Storage, and the NAND contents could be lost irreversibly. The family was in financial difficulty, the father unable to work, the little sister left unregistered at school due to unpaid debt. Time and technical complexity together, a winning strategy essential.
02 DSET's Approach
T+0, First response and preservation of the device
The DSET mobile forensics team took the device from the family's lawyer in 47 minutes. It was placed in a Faraday Tent, and cellular and WiFi and Bluetooth were physically disabled. The Apple iCloud remote erase command will not be able to reach the device. The data ownership authorization signed by the lawyer and family, the death certificate, and the certificate of inheritance were placed in the file. A chain of custody document was started.