When you are doing a forensic extraction,
your tools will provide a clue if you're
dealing with a locked backup.
So here, you can see we're using UFED.
And it tells you it's Beth's iPhone.
It says iOS 14.4.2, Not encrypted.
If this said encrypted, you would need the passcode
that Beth set on her iPhone.
Because it says not encrypted, the next screen
is so important.
It's saying, "To extract user credentials from the iOS
device, backup encryption should be enabled.
Encryption is automatically disabled at the end
of a successful extraction."
Not always-- so keep that in mind.
Enable backup encryption will temporarily
set the passcode to 1234.
You select Yes.
If you are doing something covertly,
what I recommend is, if you do this extraction,
that you quickly plug that device into Finder or iTunes
before you give it back, and make sure
encrypt is still not checked.
If it is, enter 1234, and uncheck it.