Elcomsoft iOS Forensic Toolkit 7.0 brings the ability to perform low-level, jailbreak-free extraction of all iPhone models running iOS 14 through 14.3, including the newest range of iPhone 12 devices. Using an Apple Developer account is strongly recommended.

Elcomsoft iOS Forensic Toolkit 7.0 brings low-level extraction support for the latest generation of Apple devices based on the A14 Bionic. This includes the entire range of iPhone 12 models running all versions of iOS 14 from the original iOS 14.0 all the way through iOS 14.3. During the extraction, iOS Forensic Toolkit images the iPhone file system and pulls and decrypts the keychain, which in turn stores the user’s passwords, certificates, authentication tokens and keys.

Our implementation does not require jailbreaking. Instead, iOS Forensic Toolkit implements jailbreak-free extraction using a built-in acquisition agent. The extraction agent supports file system extraction and keychain decryption, and covers the entire range of iOS releases since iOS 9.0 all the way up to iOS 14.3 for all iPhone models from iPhone 5s through full iPhone 12 range and iPad Air (4th generation) with no gaps or exclusions.

The result of this update is the complete, zero-gap coverage for iPhone devices without a jailbreak from iOS 9 onwards, up to and including iOS 14.3 on supported devices. With this exclusive jailbreak-free coverage experts will be able to image all iPhone models based on 64-bit SoC (iPhone 5s through iPhone 12).

Agent-based extraction offers numerous benefits compared to other acquisition method. The agent does not make any changes to user data, offering the most forensically sound extraction among available acquisition methods.

Using an Apple ID registered in Apple’s Developer Program is strongly recommended for installing the agent as it alleviates the need to open Internet access on the device. More about that in Why Mobile Forensic Specialists Need a Developer Account with Apple [article]. A workaround is available to Mac users.

Release notes:

• Added support for Apple devices running iOS 14.0 through 14.3 via extraction agent (full file system and keychain)
• Added support for A14 Bionic devices (full iPhone 12 range and iPad Air 4th generation)
• Gapless jailbreak-free extraction coverage for all devices running iOS 9.0 through 14.3
• Minor bug fixes and improvements