Where you are being asked to extract emails fom Iphone 4s and 5s onsite you should inform the investigators that there are currently no tools available to extract that data. This data is protected and it is not possible to extract or access it. It wouldn't make a difference if you were doing it in the lab then you still wouldn't be able to provide them.
A possible solution would be if the device was jailbroken. Dependant on the version of iOS it may not be supported to jailbreak and these days I find it is quite rare to find anyone who cares enough to jailbreak the devices these days. Jailbreaking a suspects device is not good as there is always the possiblilty of destroying or corrupting it. There may well be some users who may do so but there are too many dangers associated with it. If it was easy and it worked everyone would be using the method.
Unfortunately usually these days a number of avenues are possible. Obtain the user's email accounts from the device and serve a production order on the provider for a copy of the email. This can be more beneficial as not all email may be on the device but may be with the provider. You could always find out the Apple ID details and try to obtain a production order for backup files from the device. The other more painful option is to carry out a manual examination of the emails by photographing the screen for each page of emails and attachments.
↧