Elcomsoft iOS Forensic Toolkit Perform

Elcomsoft iOS Forensic Toolkit Perform full file system and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image.
 

Full low-level extraction with keychain decryption for iOS 16.0 - 16.6.1

Low-level file system extraction and keychain decryption are now available for a wider range of iOS versions than ever. Full low-level extraction is now available for iOS 16 through 16.6.1. The new methods support devices built with the A11 and newer chips, effectively covering the iPhone 8/8 Plus/iPhone X, as well as the iPhone Xs/Xr through iPhone 14/14 Pro range, and supports many iPads including those based on Apple M1 and M2 chips.


Ulepszona obsługa starszych urządzeń: montowanie obrazów HFS w systemach Windows i Linux

Najnowsza aktualizacja umożliwia użytkownikom systemów Windows i Linux montowanie obrazów dysków HFS wyodrębnionych ze starszych urządzeń Apple. Ta nowa funkcja umożliwia ekspertom wydajne przetwarzanie i analizowanie dowodów cyfrowych pochodzących ze starszych urządzeń Apple na komputerach z systemem Linux i Windows.


The following extraction methods are supported:
 

• Advanced logical acquisition (backup, media files, crash logs, shared files) (all devices, all versions of iOS)
• Direct agent-based extraction (all 64-bit devices, select iOS versions)
• Forensically sound bootloader-based checkm8 extraction (select devices)
• Passcode unlock and true physical acquisition (select 32-bit devices)

Advantages and functions:
 

• Repeatable results. Checksums of subsequent extractions will match the first one if the device is kept powered off and never boots iOS between sessions.
• Supports iPhone X, iPhone 8/7/Plus, 6s/6/Plus, SE (original), iPhone 5s
• Supports a wide range of Apple models in total including 25 iPhones, 40 iPads, 3 iPods, 4 Apple TV and 4 Apple Watch models
• Wide iOS compatibility. iOS 3 through iOS 16 are supported (no support for iOS 16 on A11 Bionic iPhones).
• Unaltered system and data partitions.
• Zero data modification policy: 100% of the patching occurs in the RAM.
• The installation process is fully guided and extremely robust.
• Locked devices supported in BFU mode, while USB restricted mode can be completely bypassed.

Unlocking and Imaging Legacy Devices: iPhone 3G/3GS, 4, 4s, 5, and 5c


The Toolkit can be used to unlock encrypted iPhone 3G/3GS, 4, 4s (1), 5 and 5c devices protected with an unknown screen lock passcode by attempting to recover the original 4-digit or 6-digit PIN. This DFU attack takes only 12 minutes to unlock an iPhone 5 protected with a 4-digit PIN, while 6-digit PINs will take up to 21 hours. A smart attack will be used automatically to attempt cutting this time as much as possible. In less than 4 minutes, the tool will try several thousand most commonly used passcodes such as 000000, 123456 or 121212, followed by 6-digit PINs based on the dates of birth. With 74,000 of those, the smart attack takes approximately 1.5 hours. If still unsuccessful, the full brute force of the rest of the passcodes is initiated.

Product placed on the market in the EU before December 13, 2024: YES

Warnings and Safety Guidelines for Software Use

Based on the requirements of Regulation (EU) 2023/988 on General Product Safety (GPSR), we present a list of safety warnings. The purpose is to protect users from potential hazards resulting from improper use of products/devices/software. The warnings are formulated in a simple and understandable way to ensure accessibility for a wide audience, including elderly people and individuals with mobility limitations.

List of hazards and safety precautions for software use

1. Risk of data loss or system damage
* Hazard: improper installation, deletion of system files, or lack of backups.
* Precautions: always perform regular backups; install software only from trusted sources.

2. Exposure to cyberattacks (viruses, malware)
* Hazard: downloading files from unverified websites, lack of antivirus protection.
* Precautions: use up-to-date antivirus programs, avoid opening suspicious email attachments, enable automatic updates.

3. Hardware overload and overheating
* Hazard: intensive software use (e.g., graphics processing, floating-point calculations, BF) may lead to device overheating.
* Precautions: use the device in a well-ventilated area, do not cover ventilation openings. If overheating occurs – turn off the device and wait several minutes for it to cool down.

4. Risk of electric shock and cuts (indirect)
* Hazard: although software itself poses no physical risk, improper use of computer equipment (e.g., touching cables in a damp environment) while using programs can be hazardous.
* Precautions: never operate computer devices with wet hands, avoid working in damp rooms, and regularly check cables and casings.

5. Health risks from prolonged use
* Hazard: eye strain, back pain, wrist and shoulder discomfort caused by long hours of computer work using office software.
* Precautions: take regular breaks every 45–60 minutes, use an ergonomic chair and keyboard, and position the monitor at eye level.

6. Dangers for children and inexperienced users
* Hazard: children may accidentally download harmful programs or share personal data.
* Precautions: enable parental controls, do not leave children unattended at the computer, and educate them about safe online behavior.

7. Problems in high-humidity or high-temperature environments
* Hazard: using software in high-temperature conditions (e.g., laptop on the lap in direct sunlight) or in humid environments (e.g., kitchen, bathroom) can cause hardware failure and indirect user risks.
* Precautions: use the equipment in suitable climate conditions, avoid using it near heat sources or in high-humidity areas.

8. Risks related to maintenance and updates
* Hazard: lack of software updates may create security vulnerabilities – unskilled attempts to modify the system may result in data loss.
* Precautions: always install official updates; do not modify system files without technical knowledge. Use authorized service support.

Importance of Following Warnings
Adhering to the above warnings minimizes the risk of bodily injury, equipment failure, and material loss. Ignoring these recommendations may lead to serious health and property hazards. Ensure your safety and that of others by following the indicated precautions. Detailed warnings or safety information about the product can be found in the user manual included with the product or available as a PDF on the manufacturer’s/supplier’s website.