It is important to repeat testing for new versions of OS to ensure you know what you are doing to your evidence before you do it. Testing of the hash values of database files (shown in part above) before and after the Reset All Settings process shows that many of the hash values remain the same, indicating that the data within them is not changed during the reset process. The file modified/created/and last accessed dates of the database file may still be changed, though.

Not all of the databases are unaffected, though, and this is important to keep in mind. It is extremely important to test this process using test phones with the particular version of iOS from your case if you decide that using it is appropriate in your case. In the instances where hash values didn’t match, additional fields were found to be added to tables within the databases and no data loss was noted.

If you are dealing with an iOS device as evidence from a civil or criminal case with a previously encrypted backup, obviously you will need to consider the ramifications of making changes to the original device and weigh that into the equation. Be sure you have the legal authority to make changes to the device and remember that careful documentation of the process is essential.