Assessing whether a phone can be examined begins with a specific evidential question. Establishing the date of a call requires different material from analysing the content of a conversation or searching for remnants of deleted data. The terms ‘bypass’, ‘root’ and ‘jailbreak’ describe ways of extending access. They do not, on their own, determine whether the results are complete. Having MOBILedit ULTRA and Connection Kit makes it possible to consider the available functions within the limits of their compatibility, licences and authorisation to conduct the examination.
System privileges and material for analysis
Root means elevated privileges in Android, while jailbreak refers to modifying restrictions in iOS. They may increase the range of accessible files. ‘Bypass’ is a broader term for methods of overcoming particular access restrictions. Each description must explain which barrier is involved: communication, file permissions, a lock or encryption. The manufacturer distinguishes ordinary data acquisition from the advanced functions available in ULTRA. [1] [2]
The presence of a function in the software does not mean the entire operation is performed automatically. For example, in the palera1n documentation the manufacturer explicitly states that MOBILedit provides instructions but does not perform this jailbreak automatically. The article explains the method’s significance; it does not provide instructions for performing it. [3]
Acquisition, decryption and interpretation
Assessing the result requires three separate findings. The first concerns what material was actually acquired. The second is whether its content was accessible once encryption was taken into account. The third is whether the data was correctly interpreted and related to the examination question. The manufacturer allows an encrypted image to be acquired with possible later analysis in mind. This is not a promise of future decryption. [4]
Likewise, the term ‘full file system’ must be related to the specific result. Access to a database file does not establish whether its records are readable, attachments have survived or deleted content can be reconstructed. The scope must be described using the data obtained, rather than the name of the selected function alone.
Why jailbreaking does not remove every limitation
MOBILedit documentation states that iOS encryption remains active after jailbreaking. Relevant factors include the device’s state after a restart and file protection in individual applications. The outcome of one examination provides no basis for promising the same access on another phone. [5]
Elevated privileges should not be equated with taking over the owner’s account or removing every lock. For an opinion, an inventory of available and unavailable data categories is more valuable than the general statement ‘the phone was unlocked’.
Intervention requires justification and documentation
Before the operation, establish the extent of lawful access, its purpose and the possible changes to the material. Rooting or jailbreaking should not be presented as neutral preparation for every phone. The manufacturer describes the risks of changing privileges and also warns that resetting settings may cause certain data to be lost. [1] [5]
The documentation should retain a description of the initial condition, the reasons for the method selected, software versions, the course of the work and limitations. MOBILedit saves an extraction log that helps reconstruct the actions performed. The log must be assessed together with the material to which it relates. [6]
Hypothetical example
A phone and an earlier conversation export are submitted for analysis. The question concerns one message from a particular day. The origin and scope of both sources must first be assessed. Broader access to the phone may be useful if it can explain a specific gap. The mere availability of a method does not justify extending the intrusion without identifying the finding expected from that action.
How to formulate a reliable result
The report should identify the data source, scope of acquisition, method of interpretation and unresolved issues. A statement that no message was found in the examined material must specify the limits of the search. It is not automatically proof that the message never existed. Separating these levels allows readers to assess which conclusions follow from the data and which remain hypotheses.
Sources
Manufacturer documentation; verified: 1 November 2026.