Apple stores use
this device for "cloning" iOS devices:
It's called the
Cellebrite UME36Pro. It's job is basically, take an image of the data from an unlocked cell phone, and transfer it to a new device.
Apple store employees use these guys whenever a device swap is necessary, and there's doubt as to whether a user has an iCloud backup of their data. If you don't use iCloud, or appear particularly clueless about it, they'll use the Cellebrite devices to transfer data over to any replacements, so you can still walk out of the store with a working iDevice with all your data and apps.
The devices can also be used when someone is buying an iPhone and wants to migrate their data from a different device, like a dumbphone or some Android/Blackberry/Windows phone models. Contacts info, texts, and basic phone history data can be migrated over. Apps and other platform-specific things, obviously won't transfer.
For this device to work, the phone HAS to be unlocked. The cloning process takes a couple minutes. The devices aren't supposed to be out in the open like this. Why they were out when I was at an Apple store I'll never know, but I didn't pass up the opportunity to snap a photo.
Now, if you want to take the tinfoil hat perspective: theoretically, yes, a person using this device on your passcode-unlocked iPhone could take all of its contents and store it on an SD card. Could they replicate it on multiple other devices? Yes, they could.
In fact,
there's a law enforcement version of this device that does exactly this, along with some additional software to brute-force through weak 4-digit passcodes, and download the image to a PC for forensic analysis, including looking for fragments of deleted data.
Would an Apple store employee do that? Well, they're not
supposed to. Once they've done what they need to do with your phone exchange, the image is supposed to be deleted. Whether that happens or not of course depends on the Apple store employee being ethical enough to do so. You kinda have to trust that they are.
If you don't trust them with your data, then your best bet is to use iCloud backups. If you don't trust Apple
at all with your data, then make local encrypted backups on your desktop through iTunes. And never hand an Apple store employee an unlocked iOS device, unless it's been wiped.
