Complete a complete file system and logical device acquirement for the phone, ipad, and ipod Touch. Collect apparatus secrets( passwords, crypto keys, and protected data ), then decipher the file product image.
A new extraction technique based on the modified bios is introduced by ios Forensic Toolkit 8 for Mac for some ios products. The new extraction method is the cleanest however, enabling quotable, factual extractions and exhaustively rhythm workflow.
The meticulously sound bootloader – level removal technique is applicable for 76 Apple devices ranging from the ancient iphone 4 all the way up to the iphone X, a large number of ipad, ipod Touch, Apple Watch, and Apple Tv types. The newly developed checkm8 extraction process supports a range of major Os releases from ios 7 through ios 16.2 in three different flavors( ios, tvos, watchos ) for three different architectures( arm64, armv7, armv7k ).
For devices based on the armv7 and armv7k layout maximum passwords unlock along with register system extraction and keychain decryption are available. For newer arm64 – based computers, full file system recovery and keyring decryption are supported for systems with a known or open passwords.
Elcomsoft ios Forensic Toolkit can extract keychain items including those protected with Thisdeviceonly attribute, opening investigators access to highly sensitive data such as login / password information to Web sites and other resources( and, in many cases, to Apple Id ).
The device may remain unlocked during the whole keychain acquisition process. ios Forensic Toolkit implements a program to remove involuntary display switch.
The primary aspects of Elcomsoft ios Forensic Toolkit are: