iOS Forensic Toolkit 3.0 adds full physical acquisition support for previously unsupported versions of iOS 10 as well as iOS 11.0 through 11.1.2. In addition, EIFT 3.0 adds the ability to extract data from certain apps even without jailbreak.

iOS Forensic Toolkit receives a major update, greatly expanding available acquisition options for both jailbroken and non-jailbroken devices. iOS Forensic Toolkit 3.0 adds support for the plethora of newly emerged jailbreaks, adding support for all iOS 10 devices up to and including iOS 10.2, as well as iOS 11.0 through 11.1.2. In addition, experts can now extract data from many third-party apps without a jailbreak.

iOS Forensic Toolkit 3.0 is now providing all possible options for extracting and decrypting data from both jailbroken and non-jailbroken devices, including the last generations of Apple hardware and software. Without a jailbreak, experts can perform logical extraction through iOS system backups as well as app data and media file extraction. If a jailbreak can be installed, experts can make the complete bit-precise image of 32-bit devices or image the file system of 64-bit iPhones and iPads.

Elcomsoft iOS Forensic Toolkit 3.0 adds support of several new jailbreaks including LiberIOS (iOS 11.0-11.1.2), Electra (iOS 11.0-11.1.2), h3lix (iOS 10.0-10.3.3, 32-bit), and Meridian (iOS 10.0-10.3.3, 64-bit), enabling physical acquisition support for 32-bit devices running iOS 10.0 through 10.3.3 as well as 64-bit devices running iOS 10.0 through 10.3.3 and iOS 11.0 through 11.1.2. Since iOS 10.3.3 was the final version of iOS 10 and the last version of iOS available for 32-bit devices such as the iPhone 5c or the original iPad mini, iOS Forensic Toolkit 3.0 can capture and decrypt the complete data partition of 32-bit devices running all versions of iOS.

iOS Forensic Toolkit 3.0 adds the ability to access stored files of many apps, extracting crucial evidence from 32-bit and 64-bit devices without a jailbreak. While access to app data without a jailbreak is limited, this new technique allows extracting Adobe Reader and Microsoft Office locally stored documents, MiniKeePass password database, and a lot more. The extraction requires an unlocked device or a non-expired lockdown record.