Elcomsoft Phone Viewer is updated to support file system images produced by GrayKey in the course of iOS physical extraction. In addition, version 4.30 is now able to automatically locate iOS backups produced by Microsoft Store version of Apple iTunes.

Viewing GrayKey File System Images

Since the introduction of the iPhone 5s, Apple’s first 64-bit iPhone, physical acquisition has never been the same. For all iPhone and iPad devices equipped with Apple’s 64-bit processors, physical acquisition is exclusively available via file system imaging. The imaging is performed on the device itself in order to bypass full-disk encryption.

GrayKey is one of the few forensic solutions that can break into locked iPhone devices and extract the content of the device. While Elcomsoft iOS Forensic Toolkit dumps the content of the file system in the TAR format, GrayKey saves iOS file system images into a compressed ZIP. Analysing GrayKey output is either a time-consuming and labour-intensive manual process requiring a high level of expertise, or requires the use of a highly sophisticated forensic suite, with nothing in between. Elcomsoft Phone Viewer 4.30 offers a lightweight and convenient third option, enabling fast and easy analysis of evidence extracted by GrayKey.

Supporting Microsoft Store Version of iTunes

Since April 2018, Apple iTunes has been made available for Windows 10 users from the Microsoft Store as opposed to a stand-alone download from Apple’s Web site. While the iTunes app is offering similar functionality to the previously available desktop version, it will be updated and available through the Microsoft Store. The Microsoft Store version or iTunes offers multiple advantages over the stand-alone edition. The Microsoft Store edition includes none of the resource-intensive bloatware such as Apple Software Update, Bonjour, and other helper background services.

The default download link on Apple’s Web site now steers Windows 10 users directly to Microsoft Store, making the Microsoft Store version the default edition of iTunes. The new iTunes app follows the same path conventions as other Microsoft Store apps. As a result, local backups made with this version of iTunes are stored on the users’ computers in a very different place compared to the stand-alone edition.

Elcomsoft Phone Viewer 4.30 now fully supports the Microsoft Store edition of Apple iTunes, automatically detecting and parsing local iOS backups it produces.

Release notes:

• Added support for GrayKey *.ZIP archives (physical extraction)
• Windows 10: added the ability to automatically detect backup location for Microsoft Store version of Apple iTunes
• Improved handling of HEIC (HEIF) images in Media and Messages plugins
• Fixed support for Notes attachments in iOS 10.2 and newer backups
• Improved support for deleted Health data
• Help files now supplied in PDF format instead of CHM