In my personal experience with an iPhone, it will not backup to iCloud without wifi and it will not connect to wifi without having the passcode entered at least once since boot. According to the government, the device was found powered off. If that is true, the iCloud backup would never have worked.

The government ran its own tests of the scenarios and found that to be true: https://www.scribd.com/doc/303759192/Declaration-by-Stacey-P... (paragraphs 37-39)

Apple's engineer's response left that assertion unchallenged (while challenging other stuff wrong with paragraphs 37-39, see his paragraphs 32-33): https://www.scribd.com/doc/304898553/SUPPLEMENTAL-DECLARATIO...

Of course, you can choose not to believe the government that the phone was found powered off (http://www.wired.com/wp-content/uploads/2016/03/Apple-govt-R...), but I think you'd have to pick and choose what you're willing to believe and not believe from what the government have said.

Finally, even though it wouldn't have helped, it's clear Pluhar's team did not consider the iCloud backup possibility when they were making their examination, so they very well could have screwed this up. It's just that they didn't in this case.

It's also possible the phone was actually found powered on and the battery was drained and it turned off by the time Pluhar's team examined it the same day. It wasn't mentioned if anyone checked it and tried to make sure it was kept charged (probably not). I imagine it might be difficult to train the officers on the ground about mobile device forensics best practices, since they change fairly frequently.

user:	kernel_task
created:	April 22, 2016
karma:	1