Elcomsoft Delivers Forensically Sound Extraction without a Jailbreak for Current iPhone Models and iOS Releases

ElcomSoft Co. Ltd. updates iOS Forensic Toolkit, the company’s mobile forensic tool for extracting data from a range of Apple devices. Version 6.0 expands the ability to perform full file system extraction without the need to install a jailbreak, adding support for recent versions of iOS including iOS 13.3.1, 13.4 and 13.4.1. The tool now covers the entire range of iOS versions from iOS 11 through the latest iOS 13.4.1 for all Apple device models from the iPhone 6s all the way up through the iPhone 11 range.

“It’s been a long while since we’ve been able to deliver file system extraction support for the current generation of hardware running recent versions of iOS”, says Vladimir Katalov, ElcomSoft President and CEO. “Extracting data from the latest and toughest generations of Apple devices is becoming increasingly relevant. By carefully following the latest advances in iOS security researches, we strive to deliver forensically sound solutions offering a unique opportunity to quickly access crucial evidence and make a breakthrough in the investigation.”

About Jailbreak-Free File System Extraction

Low-level access to the file system in Apple’s 64-bit iOS devices requires privilege escalation. For years, a jailbreaks was required in order to gain the required level of privileges. The innovative checkra1n jailbreak, however, was never made unavailable for the A12 and A13 generation devices, leaving us no choice but to develop an in-house direct extraction tool.

iOS Forensic Toolkit 6.0 offers direct, forensically sound extraction without a jailbreak of virtually any iOS device up to and including the latest iPhone 11 range with iOS 11 through 13.4.1. The latest release plugs one more gap of excepted and unsupported iOS releases, adding full file system extraction support to the iPhone 6s, 7, 8, X, Xr/Xs, 11, and 11 Pro generation of devices running iOS 13.3.1, 13.4, and 13.4.1.

Agent-based extraction delivers solid performance and results in forensically sound extraction with automatic on-the-fly hashing of information being extracted. At this time, keychain extraction is only available for iOS versions up to and including iOS 13.3. For newly supported versions of iOS, the extraction agent currently supports file system imaging.

Compatibility Matrix

Supported devices include the following models:

• NEW in EIFT 6.0: iPhone 6s through iPhone 11, 11 Pro and 11 Pro Max: iOS 13.3-13.4.1 (full file system only)
• iPhone 6s through iPhone 11, 11 Pro and 11 Pro Max: iOS 11-13.3 (full file system + keychain)
• iPhone 5s and iPhone 6: iOS 11-12.2, iOS 12.4
• iPad models based on A9..A12/A12x SoC (iOS 11 to iPadOS 13.4.1) with the same compatibility notes regarding keychain extraction

In addition, experts must use a valid Apple ID enrolled in Apple’s Developer Program to sign the agent.

Pricing and Availability

Elcomsoft iOS Forensic Toolkit 6.0 is immediately available in Windows and Mac editions. North American pricing starts from $1,499 (local pricing may vary). Both Windows and Mac OS X versions are supplied with every order. Existing customers can upgrade at no charge or at a discount depending on their license expiration. Elcomsoft iOS Forensic Toolkit is available stand-alone and as part of Elcomsoft Mobile Forensic Bundle, which offers many additional features including cloud extraction.

About Elcomsoft iOS Forensic Toolkit

Elcomsoft iOS Forensic Toolkit provides forensic access to encrypted information stored in popular Apple devices running iOS, offering file system imaging and keychain extraction from the latest generations of iOS devices. By performing low-level extraction of the device, the Toolkit offers instant access to all protected information including SMS and email messages, call history, contacts and organizer data, Web browsing history, voicemail and email accounts and settings, stored logins and passwords, geolocation history, the original plain-text Apple ID password, conversations carried over various instant messaging apps such as Skype or Viber, as well as all application-specific data saved in the device.

About ElcomSoft Co. Ltd.

Founded in 1990, ElcomSoft Co.Ltd. is a global industry-acknowledged expert in computer and mobile forensics providing tools, training, and consulting services to law enforcement, forensics, financial and intelligence agencies. ElcomSoft pioneered and patented numerous cryptography techniques, setting and exceeding expectations by consistently breaking the industry’s performance records. ElcomSoft is Microsoft Certrified Partner, and Intel Software Premier Elite Partner.