COLOMBO — Investigators examining the circumstances surrounding the death of former SriLankan Airlines Chief Executive Officer Kapila Chandrasena are pursuing assistance from Apple, specialist institutions overseas and a telecommunications provider to recover potentially relevant information associated with his locked iPhone.
The developments have generated considerable interest, particularly because investigators previously informed the Colombo Fort Magistrate’s Court that they could not access the device.
During proceedings on 4 November 2026, the Colombo Crimes Division (CCD) reported that requests had been directed to two institutions, including a company based in Singapore, to obtain information from the phone.
The court also permitted investigators to pursue an order concerning the conversion of the device’s electronic SIM, or eSIM, into a conventional SIM card.
Separately, investigators informed the court that data associated with Chandrasena’s phone would be preserved for another three months.
These steps reveal an investigation involving three different technical challenges: accessing a physically locked device, obtaining information stored by Apple and examining records associated with the mobile connection.
To understand why investigators are pursuing several avenues simultaneously, it is necessary to distinguish what each can achieve.
1. Why Can’t Apple Simply Unlock the iPhone?
Modern iPhones use hardware-backed encryption designed to protect information stored on the device.
One of the central components is Apple’s Secure Enclave, a dedicated security subsystem that helps protect sensitive information and manages important security functions.
When a passcode is enabled, the protection of stored data is linked to cryptographic processes involving the device and the passcode.
This is fundamentally different from a conventional computer account whose password might be reset by an administrator.
Apple does not possess a universal master passcode capable of opening every locked iPhone.
Nor does receiving a court order automatically give Apple the ability to decrypt information stored only on a device protected by a passcode.
Several safeguards also restrict repeated attempts to guess the correct passcode.
Consequently, investigators cannot assume that possessing the physical handset will allow them to examine its photographs, messages, application data and other protected contents.
Whether information can be recovered depends on factors including the device model, software version, security settings and condition of the handset.
Earlier court reporting identified Chandrasena’s device as an iPhone 16 Pro Max.
Its security protections make the recovery process particularly challenging, although it would be premature to declare forensic examination either impossible or certain to succeed.
2. Why Are Investigators Contacting Apple?
The crucial distinction is between information stored on the physical iPhone and information associated with the owner’s Apple account.
Although Apple may be unable to unlock a passcode-protected handset, it can respond to legally valid requests for certain information held within its services.
That information may include account records and eligible material stored in iCloud.
Preserving Data Before It Disappears
Apple maintains a formal procedure through which law enforcement agencies can request preservation of existing account data.
Under its published guidelines, preservation generally involves retaining a copy of available information for 90 days while authorities pursue the necessary legal process.
This does not mean Apple has permanently frozen every record associated with an account.
It means eligible information available at the time of preservation is retained under the applicable procedure.
During October proceedings, investigators reported that the relevant preservation period was approaching its expiry on 29 November.
That deadline was important because information could become unavailable if preservation arrangements were not extended or the required legal process was not completed.
The latest court proceedings indicate that an additional three-month preservation period has been communicated.
Preservation, however, is not the same as disclosure. Investigators must still satisfy the applicable legal requirements before receiving information.
What Information Might Apple Provide?
Depending on what exists in the account and how it is protected, potentially available information could include:
- Apple account registration and associated identifying information.
- Certain account-access and connection records.
- Email content held in iCloud Mail.
- Contacts and calendars.
- Photographs and documents stored under standard iCloud protection.
- Eligible device backups and information contained within them.
The existence of any particular category of information in Chandrasena’s account has not been publicly established.
Its availability would depend on the account’s settings, whether the data had been uploaded and the legal requirements governing disclosure.
3. How Does Advanced Data Protection Change the Situation?
Apple offers an optional feature called Advanced Data Protection for iCloud.
When enabled, it extends end-to-end encryption to additional categories of stored information, including iCloud Backup, Photos, Notes and iCloud Drive.
Under this arrangement, Apple does not hold the keys needed to decrypt those categories.
A legally valid request cannot compel a company to produce readable data that it does not technically possess the means to decrypt.
Importantly, some information remains accessible to Apple even when Advanced Data Protection is enabled.
For example, iCloud Mail, Contacts and Calendars are not protected by Advanced Data Protection in the same way as photographs or iCloud backups.
Investigators must therefore establish which protections were active and which categories of data, if any, remain technically available.
There has been no public confirmation of whether Chandrasena had enabled Advanced Data Protection.
That uncertainty is central to understanding what Apple may ultimately be able to supply.
4. Why Seek Assistance from a Company in Singapore?
Investigators have also approached a company based in Singapore for assistance in obtaining information from the handset.
The company has not been publicly identified in the available reporting.
Its involvement suggests that investigators are exploring specialist digital forensic capabilities beyond those immediately available domestically.
Digital forensic laboratories may use specialised hardware, software and analytical techniques to examine electronic devices and recover information where technically possible.
Commercial forensic technology providers include companies such as Cellebrite and Magnet Forensics, which acquired the GrayKey technology business.
However, there is no verified information establishing that either company is involved in Chandrasena’s investigation.
What Can Digital Forensic Tools Actually Do?
The capabilities of forensic tools vary substantially.
Some can recover information from devices that are already accessible. Others may extract limited information from locked devices under particular technical conditions.
Advanced methods sometimes rely on vulnerabilities or other device-specific capabilities.
Their success depends heavily on the security architecture and software state of the phone under examination.
It would be misleading to suggest that forensic software can routinely disable an iPhone’s security safeguards and test thousands of passcodes every second.
Modern iPhones incorporate hardware-enforced protections specifically intended to resist such attacks.
Investigators must also preserve the integrity of the device and maintain a reliable chain of custody so that any recovered evidence can be assessed in court.
Forensic examination therefore involves more than obtaining access. It requires documenting what was recovered, how it was recovered and whether the resulting information can be trusted.
The Singapore request should be understood as an attempt to explore available forensic options, not proof that the handset can be unlocked.
5. Why Convert the eSIM into a Physical SIM?
Another development concerns the investigators’ request to convert the phone’s eSIM into a conventional SIM card.
An eSIM performs the cellular network function of a physical SIM but is installed digitally within a compatible device.
Both are associated with a mobile subscription managed by a telecommunications provider.
The reported request raises an obvious question: what information could investigators obtain from the mobile connection if they still cannot unlock the iPhone?
The answer depends on the records and services involved.
What a Mobile Connection Can Reveal
Subject to lawful authorisation and the provider’s retention policies, investigators may be able to obtain relevant telecommunications information.
Such material can include:
- Subscriber identification records.
- Available call-detail records.
- Records of SMS activity.
- Certain network connection information.
- Other records held by the telecommunications provider.
A provider may already possess some of this information independently of the SIM card.
Consequently, converting an eSIM into a physical SIM is not necessarily required to obtain historical telecommunications records.
The investigators’ precise technical purpose for requesting the conversion has not been publicly explained.
What an eSIM Conversion Cannot Do
Changing a subscription from an eSIM to a physical SIM does not decrypt the original iPhone.
It does not automatically recover previously stored WhatsApp conversations, Telegram messages, photographs or application databases.
Nor does possession of a SIM automatically provide access to protected email, financial or messaging accounts.
Modern services may employ additional authentication requirements, device verification and end-to-end encryption.
The availability of subscriber information should therefore not be confused with unrestricted access to private application content.
6. Why Are Several Methods Being Pursued Together?
The investigative approach becomes clearer when the different sources of potential evidence are considered separately.
The physical iPhone
May contain locally stored photographs, communications, application information and other records, subject to the device’s encryption and accessibility.
Apple and iCloud
May hold eligible account information, backups and cloud content, depending on the account’s configuration and applicable legal process.
The telecommunications provider
May hold subscriber and network records that exist independently of the data stored inside the handset.
Specialist digital forensic assistance
May help investigators determine whether technically recoverable information remains on the device.
Each source can potentially answer different questions.
Information recovered from one source might help establish a chronology or be compared with records obtained from another.
However, there is no guarantee that these sources will contain the material investigators are seeking.
7. What Happens Next in the Chandrasena Investigation?
The phone examination forms only one component of the inquiry into Chandrasena’s death.
During the 4 November proceedings, Colombo Fort Magistrate Pasan Amarasena also sought explanations concerning delays in forensic reporting.
The Government Analyst was directed to address the outstanding reports, while the Judicial Medical Officer was instructed to submit the complete post-mortem report.
Investigators told the court that a report relating to four types of medication recovered from the location where Chandrasena was found dead had not yet been received.
The proceedings are scheduled to resume on 2 December.
The results of the phone-related requests could assist investigators, but their significance will depend on whether any information is recovered and how it relates to other evidence.
The central lesson is that digital investigations do not necessarily depend on defeating a single device’s security system.
Modern communications generate information across several distinct environments, each governed by different technical protections and legal requirements.
For investigators, the challenge is to identify what information exists, obtain it lawfully and establish its evidential reliability.
Whether those efforts will produce material relevant to Chandrasena’s death remains unresolved.
