Mobile Forensics · Cloud & Account Evidence · Lesson 4 of 5

Encryption Limits

Learn what a provider can't hand over, what it still can, and why it's debated.

What the provider can't hand over

Legal process can only reach what a provider can actually read. When data is end-to-end encrypted (E2EE), the keys live only on the user's devices, so the provider holds scrambled data it can't decrypt. A warrant can require a company to hand over what it has. It can't make the company produce keys it never had.

Some examples you've met before, seen through an investigator's eyes:

• Advanced Data Protection. With ADP on, iCloud Backup, iCloud Drive, Photos, Notes and several other categories join the ones Apple already protects end to end by default. Apple deletes the matching keys from its data centers, so it can't decrypt that data for anyone, including itself.
• Signal. Signal is built to keep as little as possible. In its published response to a 2016 grand jury subpoena, Signal said the only information it could produce was the date and time a user registered and the last date the user connected to the service.
• WhatsApp. Personal chats are end to end encrypted, so message content isn't readable on WhatsApp's servers. Chat backups are only end to end encrypted if the user turns that option on.
• Android backups. Google says some backed-up data is end to end encrypted with the phone's screen lock PIN, pattern or password. It also says photos and videos in Google Photos aren't encrypted with the screen lock.

Notice the pattern. The same person's data can be partly sealed and partly open, depending on the service and the settings. An investigator planning a request needs to know which parts the provider can actually read, or the request may come back nearly empty.

The phone itself is a separate question. Messages that are sealed on a server may still be readable on a device examined lawfully in the lab, which is one reason phone and cloud evidence work together.

What's left, and the going dark debate

Even with end-to-end encryption, a lot can remain available to a provider, and so to lawful process:

• Account information, such as the name, email address or phone number used to sign up, and payment details.
• Metadata, data about data, such as when an account signed in and from which IP address. Services differ a lot in how much they keep.
• Data outside E2EE. Apple says iCloud Mail, Contacts and Calendar aren't end to end encrypted, even with ADP, so they work with standard email and calendar systems. Photos in Shared Albums use standard protection too.
• Some metadata under ADP. Apple says it can still read dates and times when files were modified, and it keeps the keys for certain checksums with standard protection.

So encryption rarely makes an account a total blank. It does often remove the content, which is usually what investigators want most.

That gap is at the center of a long public debate. Law enforcement agencies have described the problem as going dark: lawful orders that can't be carried out because the data is encrypted. Some officials have asked for exceptional access, a way for providers to unlock data when a court orders it.

Many security experts, privacy groups and technology companies disagree. They argue that any built-in way in for police could also be found and used by criminals or hostile governments, and that it would weaken security for everyone. They also point out that metadata, device examinations and other sources still give investigators a lot to work with.

Countries have taken different paths. You saw in iOS Internals that Apple said in 2025 it could no longer offer ADP to new users in the United Kingdom. This course doesn't take a side. An investigator's job is to know where the limits are and plan around them lawfully.