Keychain Forensics: The Keys to the Device

The keychain is the iPhone's secure store for the credentials a device accumulates: saved account passwords, Wi-Fi network passwords, authentication tokens, certificates and other secrets that apps and the system tuck away so a user does not retype them. In an examination it is one of the most concentrated artifacts on the device, because it documents in one place which services the device held access to and which networks it joined. Sherlock Forensics iPhone Analyzer presents it as a searchable keychain view, each item shown with its account and service where the record carries them.

Wi-Fi passwords are often the highest-value entries. Every network the device saved, with its password, is a record of the places the device was configured to connect, which reads as whereabouts corroboration alongside the location artifacts. Saved account credentials document the services a person used from the device. Certificates and tokens round out the picture of the device's trusted relationships. Each is read as a stored keychain item, evidence of what the device retained, not a live login.

The keychain is the artifact where the source of the evidence matters most, so this page states the line plainly. The full keychain in the clear comes from a Cellebrite full-filesystem extraction, which ships the keychain already decrypted. From that source Sherlock surfaces the saved passwords, credentials, authentication tokens, certificates and Wi-Fi passwords in full. It is the acquisition that carries the decrypted keychain that makes this readable, not the analysis tool alone.

A Magnet VeraKey extraction is different, in a way that is decisive. VeraKey ships the keychain SEP-encrypted, so on a VeraKey image the keychain content stays locked. Sherlock reports it as locked rather than pretending to read it, because the encryption does not permit otherwise from that source. Any claim to decrypt a full keychain from every extraction would be false. This page does not make it: the full keychain in the clear is the Cellebrite full-filesystem case. A VeraKey image keeps it sealed.

There is one honest exception worth stating clearly, because it widens what is reachable without a full-filesystem extraction. Saved Wi-Fi passwords live in the keychain subset that an encrypted backup carries, so they come through an encrypted MobileBackup2 backup as well as from a Cellebrite full-filesystem extraction. That means Wi-Fi passwords do not require the Cellebrite image; a backup you make from an unlockable device (or an existing encrypted backup) surfaces the saved networks with their passwords.

The exception is specific to what the backup carries, not a blanket keychain read. A VeraKey image still keeps the keychain, Wi-Fi passwords included, SEP-encrypted and locked. The rule underneath is consistent throughout: Sherlock reads exactly what the source makes available, surfaces Wi-Fi from a backup or a Cellebrite extraction, reads the full keychain from a Cellebrite extraction and marks a VeraKey keychain locked. Nothing here is stretched past what the acquisition actually yields.

Because keychain evidence carries credentials and turns on the source, the documentation records both: the court-ready HTML report carries case and evidence numbers, examiner identification, disclosed methodology, per-artifact SHA-256 hashing and an optional evidence-integrity manifest, with the source scope stated and any locked keychain marked as locked, the documentation practice set out in NIST Special Publication 800-101 Revision 1, Guidelines on Mobile Device Forensics. Analysis is 100 percent read-only; the evidence is never modified.

Built by CISSP, ISSAP and ISSMP certified examiners with 20 years of court-defensible practice. Admissibility depends on jurisdiction, authority and evidence handling; the report documents the record so testimony rests on it rather than on recollection.

Sherlock reads the keychain that the acquired evidence carries. The full keychain in the clear comes from a Cellebrite full-filesystem extraction; a VeraKey extraction ships it SEP-encrypted and it stays locked; saved Wi-Fi passwords also come through an encrypted backup. It does not unlock a locked device, does not bypass a passcode and does not decrypt a VeraKey keychain that the Secure Enclave keeps sealed. A saved keychain item shows a credential the device stored, tied to the device, not proof of who entered it. Sherlock reports what the source makes available, states the scope and marks what is locked, which is what an examiner can defend on the stand.

Download the free edition, open a Cellebrite full-filesystem extraction and read the keychain in the clear or open an encrypted backup for the saved Wi-Fi passwords. Unlock the full analysis and the court-ready report when the case calls for it: $599 one-time, no subscription.

Get Sherlock Forensics iPhone Analyzer

Related: Recover iPhone Wi-Fi passwords · Read a Cellebrite UFED extraction · iPhone forensics fact checks · Product page