Elcomsoft claims its iOS Forensic Toolkit can now extract certain pieces of data from an iOS device before it has been unlocked.
Almost all of the data stored on an iPhone or iPad is securely encrypted after a reboot or restart — until a passcode has been entered. But the little bit that isn’t, which includes keychain records, can now be obtained.