title: How does iOS data protection work
body: <p>I have a quick question:</p>
  
  <p>I downloaded an iOS application that uses the NSFileProtectionComplete class to protect a sqlite file that contains sensitive information.</p>
  
  <p>According to the iOS security documentation (<a href="http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf" rel="noreferrer">http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf</a>), when a device (iPhone/iPad) is paired with the laptop, the laptop obtains the escrow keybag from the mobile device . The keybag contains all the class keys necessary to decrypt information on the device.</p>
  
  <p>However, I noticed that when I pair the device with the laptop and use iExplorer to browse the file system, the sqlite file is only available when the device is unlocked. When the phone is locked (still paired) the file is not readable. Files which are not using NSFileProtectionComplete can be viewed while the device is locked.</p>
  
  <p>If the escrow keybag contains all the class keys to decrypt information, why do I have to unlock the device to access it through iExplorer?</p>
  
  <p>I'm using iOS 6.0 on an iPad3 and used the ios-dataprotection tool (<a href="https://github.com/ciso/ios-dataprotection" rel="noreferrer">https://github.com/ciso/ios-dataprotection</a>) to determine the data protection class used by the files.</p>
  
  <p>iOS Application: AccountVault<br>
  File: PointMinder.sqlite</p>
  
  <p>Any help will be appreciated.</p>
  
  <p>Thanks.</p>