I want to do a little demo for you here.
Now this is where things could go wrong.
Encryption matters.
You must encrypt.
So here on the left, we're looking at Finder on a Mac.
And you can see that I want to back up all of my data
on the iPhone.
It tells you, what do you want to do?
We want to Encrypt it and then Back Up Now.
Now, this is extremely important on what's
going to happen when you do this step.
So I'm going to see if I can show you in finder what
this is going to look like.
So the first thing I have to do, it's telling you,
hey, you have not trusted that device.
So I'm going to trust it here in a moment.
It's prompting me, Trust.
I have to enter my passcode.
And now the trust is established.
Now, this is a good indication here.
Do you see how encrypt local backup is already checked?
If I want to uncheck that, what do you think I have to do?
Enter the current passcode.
If I don't know that, I can't actually do this.
So I'm going to enter it.
I have to enter my passcode on my phone.
And now it's decrypted.
So what I want to show you that goes wrong.
You have a device that's not encrypted.
You go to check the box.
It asks you, what do you want it to be?
I'm going to make mine 0000.
Verify password, 0000.
Do you see this default checkbox?
It says remember this password in my keychain.
If you do this, your forensic tools
will not be able to decode it even with the passcode
because that actual password is being
stored in the keychain on the Mac
instead of with that backup.
Never ever have that box checked if you're
doing this forensically.
So I'm going to say cancel.
We're going to go back to the slides.