Elcomsoft iOS Forensic Toolkit Perform

Elcomsoft iOS Forensic Toolkit Perform full file system and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image.
 

Full low-level extraction with keychain decryption for iOS 16.0 - 16.6.1

Low-level file system extraction and keychain decryption are now available for a wider range of iOS versions than ever. Full low-level extraction is now available for iOS 16 through 16.6.1. The new methods support devices built with the A11 and newer chips, effectively covering the iPhone 8/8 Plus/iPhone X, as well as the iPhone Xs/Xr through iPhone 14/14 Pro range, and supports many iPads including those based on Apple M1 and M2 chips.


Ulepszona obs³uga starszych urz±dzeñ: montowanie obrazów HFS w systemach Windows i Linux

Najnowsza aktualizacja umo¿liwia u¿ytkownikom systemów Windows i Linux montowanie obrazów dysków HFS wyodrêbnionych ze starszych urz±dzeñ Apple. Ta nowa funkcja umo¿liwia ekspertom wydajne przetwarzanie i analizowanie dowodów cyfrowych pochodz±cych ze starszych urz±dzeñ Apple na komputerach z systemem Linux i Windows.


The following extraction methods are supported:
 

• Advanced logical acquisition (backup, media files, crash logs, shared files) (all devices, all versions of iOS)
• Direct agent-based extraction (all 64-bit devices, select iOS versions)
• Forensically sound bootloader-based checkm8 extraction (select devices)
• Passcode unlock and true physical acquisition (select 32-bit devices)

Advantages and functions:
 

• Repeatable results. Checksums of subsequent extractions will match the first one if the device is kept powered off and never boots iOS between sessions.
• Supports iPhone X, iPhone 8/7/Plus, 6s/6/Plus, SE (original), iPhone 5s
• Supports a wide range of Apple models in total including 25 iPhones, 40 iPads, 3 iPods, 4 Apple TV and 4 Apple Watch models
• Wide iOS compatibility. iOS 3 through iOS 16 are supported (no support for iOS 16 on A11 Bionic iPhones).
• Unaltered system and data partitions.
• Zero data modification policy: 100% of the patching occurs in the RAM.
• The installation process is fully guided and extremely robust.
• Locked devices supported in BFU mode, while USB restricted mode can be completely bypassed.

Unlocking and Imaging Legacy Devices: iPhone 3G/3GS, 4, 4s, 5, and 5c


The Toolkit can be used to unlock encrypted iPhone 3G/3GS, 4, 4s (1), 5 and 5c devices protected with an unknown screen lock passcode by attempting to recover the original 4-digit or 6-digit PIN. This DFU attack takes only 12 minutes to unlock an iPhone 5 protected with a 4-digit PIN, while 6-digit PINs will take up to 21 hours. A smart attack will be used automatically to attempt cutting this time as much as possible. In less than 4 minutes, the tool will try several thousand most commonly used passcodes such as 000000, 123456 or 121212, followed by 6-digit PINs based on the dates of birth. With 74,000 of those, the smart attack takes approximately 1.5 hours. If still unsuccessful, the full brute force of the rest of the passcodes is initiated.