Elcomsoft iOS Forensic Toolkit 8.31 and 7.91 are once again pushing the boundaries of what is possible by enabling full low-level extraction support for iOS 16 devices up to and including iOS/iPadOS 16.4. Supported models include many recent and latest-generation iPhone and iPad models based on the Apple A12 Bionic and newer chips. For the first time ever, full file system extraction and keychain decryption become available on the iPhone 14 and 14 Pro range of devices, as well as many corresponding iPads including those based on Apple M1 and M2 chips.

The latest updates to Elcomsoft's iOS Forensic Toolkit 8.31 (Mac) and 7.91 (Windows) bring exciting news for investigators and forensic professionals, making full low-level extraction available for latest-generation iPhone and iPad devices including the current iPhone 14, iPhone 14 Plus, as well as iPhone 14 Pro and iPhone 14 Pro Max devices. Compared to the recent release, this update adds keychain decryption and iOS 16.4 support to the already available full file system extraction, making agent-based low-level extraction available for iOS 16.0 through 16.4 on all iPhone models from the iPhone Xs/Xr through iPhone 14 range, as well as many iPads, including those based on Apple M1 and M2 chips.

The new extraction method utilizes Elcomsoft proprietary extraction agent and enables keychain decryption in addition to full access to the file system. The low-level extraction agent provides the ability to extract and decrypt the user’s online account passwords, tokens, and keys, and extract sandboxed app data, system databases and other information available in the file system. In particular, the keychain stores the necessary encryption keys required to access conversations in protected instant messaging apps such as Signal.

This new update offers enhanced capabilities for forensic professionals, providing them with the ability to extract and analyze data from the latest Apple devices running select versions of iOS 16. With its expanded compatibility and comprehensive extraction features, Elcomsoft continues to offer one of the most powerful and efficient mobile forensic tools on the market.

Compatibility

Comprehensive low-level extraction is now available for a wide range of hardware and iOS builds. On all Apple devices built with the A12 Bionic and newer chips that are capable of running iOS/iPadOS 16, low-level file system extraction and keychain decryption are available for iOS 16.0 through 16.4. Notably, the new extraction method is available for the iPad models based on Apple M1 and M2 chips.

Elcomsoft iOS Forensic Toolkit 8.31 and 7.91 release notes:

• extraction agent: added full file system extraction for iOS 16.4 on A12+ devices
• extraction agent: added keychain decryption for iOS 16.0 to 16.4 on A12+ devices
• Minor bug fixes and improvements