Elcomsoft iOS Forensic Toolkit 8.40 and 7.94 expand agent-based low-level extraction of Apple mobile devices, adding support iOS 16.4.1, 16.4.1 (a), and 16.5 on A12 and newer chips, and supporting iOS 15.4 through 16.5 on A11 Bionic devices. In addition, checkm8-based extraction support was bumped to iOS/iPadOS/tvOS 16.6 and iOS/iPadOS 15.7.8.

The latest update to Elcomsoft's iOS Forensic Toolkit 8.40 (Mac) and 7.94 (Mac and Windows) brings exciting news for investigators and forensic professionals, making full low-level extraction available for iPhone and iPad devices running iOS 16.5 and older versions. Supported devices include devices built with the Apple A11 Bionic and newer chips, which includes the current generation of iPhone 14, iPhone 14 Plus, as well as iPhone 14 Pro and iPhone 14 Pro Max devices.

The latest update now offers gapless low-level extraction support for all versions of iOS 15 and 16 up to and including iOS/iPadOS 16.5, on a wide range of devices. Thanks to a new exploit, the toolkit now supports devices with Apple A12 Bionic chips running iOS 16.4.1, 16.4.1 (a), and 16.5. For older A11 chips (found in iPhone 8/8 Plus/iPhone X), the toolkit now provides complete low-level extraction across the entire range of operating systems up to and including iOS 16.5.

The updated extraction method supports a wide range of hardware, effectively covering all iPhone models from the iPhone 14 range down to the iPhone 8/8 Plus/iPhone X, as well as many iPads, including those based on Apple M1 and M2 chips, delivering full, gapless coverage of recent versions of iOS up to and including iOS 16.5.

The updated low-level extraction method utilizes Elcomsoft proprietary extraction agent, which enables full access to the file system and the keychain. The extraction agent can extract sandboxed app data, system databases and other information available in the file system.

This new update offers enhanced capabilities for forensic professionals, providing them with the ability to extract and analyze data from the latest Apple devices running select versions of iOS 16. With its expanded compatibility and comprehensive extraction features, Elcomsoft continues to offer one of the most powerful and efficient mobile forensic tools on the market.

In addition, iOS Forensic Toolkit 8.40 expands checkm8 extraction support, now supporting select Apple devices running iOS/iPadOS/tvOS 16.6 and iOS/iPadOS 15.7.8.

Additional Information

We consistently write articles to assist forensic professionals in navigating the ever-evolving landscape of mobile forensics. Please check out the following recent blog posts:

• iOS Forensic Toolkit Tips & Tricks
• iOS Device Acquisition: Installing the Extraction Agent
• Apple iCloud Acquisition: A Lifeline for Forensic Experts

Compatibility

Full low-level is now available for a wide range of hardware and iOS builds. On all Apple devices built with the A11 Bionic and newer chips capable of running iOS/iPadOS 16, low-level extraction is available for iOS 16.0 through 16.5. Notably, the updated extraction method is available for the iPad models based on Apple M1 and M2 chips.

iOS Forensic Toolkit 8.40 release notes:

• Extraction agent: added support for iOS 16.4.1, 16.4.1 (a) and 16.5 (A12-A16, M1/M2)
• Extraction agent: added support for iOS 15.4 to 16.5 (A11)
• Extraction agent: improved reliability for some iOS 15 versions
• checkm8: added support for iOS/iPadOS/tvOS 16.6 and iOS/iPadOS 15.7.8
• Enhancement: added the ability to check for current license status (expiration date) and renew licenses

iOS Forensic Toolkit 7.94 release notes:

• Extraction agent: added support for iOS 16.4.1, 16.4.1 (a) and 16.5 (A12-A16, M1/M2)
• Extraction agent: added support for iOS 15.4 to 16.5 (A11)
• Extraction agent: improved reliability for some iOS 15 versions
• Enhancement: added the ability to check for current license status (expiration date) and renew licenses