This is a problem, but I don't think Moxie would do this as it could make him liable for evidence tampering. If the protection mechanism applies to the device being scanned, its a defensive measure, if it is applied to unrelated devices, it looks like a malicious destructive action.

If the USER could select the action, for research purposes, that might a different story.

Moxie might or might not have done so. But he made it clear that he could have, and went out of his way to create reasonable doubt about whether he did.

If he winds up in court, I'd love it if he sticks to his, "the files are there for artistic effect".

Since after all, Cellebrite claims their device doesn't alter evidence on the way through. If that claim is true, Moxie's artistically-beautiful files obviously can't affect it.

Saying those decorative files tampered with evidence is equivalent to admitting that everything the Cellebrite claims to do, it doesn't do and never has done.

The vulnerabilities allow for code execution in the context of the Cellebrite application via the parsing of a video file. It doesn’t matter what the application was designed to do, you can now make it do anything you want just by getting it to scan a phone with a malicious video on it.

Yes. So Cellebrite should be writing the data to write-once storage prior to performing any analysis of the content.

In absence of write-once media, they are betting that the hashes they capture will be the same every time they image the device because they never modify the device.