We looked at these profiles in the malware section
during Section 4.
Here, we're looking at it again.
Now, let's say, you acquire this iPhone,
and you're just missing application data,
and you don't understand why.
Go into device management profiles.
And when we look at this, we can see
that it is protecting two apps.
When you click on that Apps, it's
going to tell you which two it's protecting.
Before you remove management, make
sure you have the best acquisition you
can get because, I guarantee, when you remove management,
it is going to wipe those two apps.
Because of this, what I also recommend
is that you take pictures of the screens.
Let's say, it's WhatsApp, and WhatsApp
is important to your investigation.
Photograph those screens old-school style,
camera over the phone taking pictures of it
because if you remove management,
chances are good it's going to wipe that.
If you think mobile device management is
restricting your acquisition, look at the restrictions.
So here, we have 25.
As we read down the left-hand side,
you want to look for things on iPhone
as if it said iTunes backup not allowed, trust on computers not
allowed.
But when you read these things, this may assist you.
This could also help you.
Let's say, you're working an accident reconstruction case.
You see a mobile device management profile.
Look at the restrictions.
If the person claims they did not touch their phone at all,
that it was in their backpack, and they
use Siri to send a message, you look at restrictions.
And it says, Siri while locked not allowed.
So did they look at their phone to unlock it?
Were they distracted for that period of time?
Some of these things will really assist you.