Elcomsoft iOS Forensic Toolkit 8.20 expands low-level extraction support to iOS 16.1.2 on recent Apple devices

ElcomSoft Co. Ltd. releases Elcomsoft iOS Forensic Toolkit 8.20, a major update to the company’s mobile forensic extraction tool for Apple devices. The new release delivers partial low-level extraction support to Apple devices based on the A11 through A16 Bionic and Apple Silicon chips. The latest versions, 8.20 (Mac only) and 7.80 (Mac and Windows), are designed to support models such as the iPhone 8, 8 Plus, iPhone X, all the way up to the current range of iPhone 14 through iPhone 14 Pro Max, as well as M1 and M2-based iPads.

The new low-level extraction method pulls sandboxed data and working sets of third-party apps that do not allow their data in local backups, including chat histories and conversations in many instant messaging apps, messages in third-party email clients, and many other user-installed apps. In addition, several system databases that may contain essential evidence are extracted.

Data of built-in and system apps as well as many system databases remain unavailable with the partial extraction method. For this reason, the new extraction method can and should be complemented with advanced logical extraction, which returns the missing pieces of data such as calendars, Safari browsing history, and passwords and authentication data stored in the keychain. As a result, the expert will receive the maximum amount of data and the most complete set of evidence as technically possible.

Elcomsoft will continue researching the vulnerability used in this release to extend the amount of extractable information. The company remains committed to providing innovative solutions to digital forensic investigators worldwide, and this latest release is a testament to its ongoing dedication to this mission.

Compatibility

Elcomsoft iOS Forensic Toolkit 8.20 is supported on Mac computers, while iOS Forensic Toolkit 7.80 is available for Windows users.

Partial file system extraction is available on Apple A11 through A16 Bionic iPhones, which includes the iPhone 8 through iPhone 14 range, as well as M1 and M2-based iPads. iOS and iPadOS versions up to and including 16.1.2 are supported.

Full file system extraction is available on older versions of iOS including Apple A11 devices (up to iOS 15.3.1) and A12 through A16 Bionic devices (up to iOS 15.5).

With this update, Elcomsoft iOS Forensic Toolkit remains one of the most advanced yet affordable iOS acquisition tools on the market, and is the only forensic tool for extracting Apple Watch, Apple TV, and HomePod devices. The toolkit supports all possible acquisition methods including advanced logical, agent-based and checkm8-based low-level extraction.

About Elcomsoft iOS Forensic Toolkit

Elcomsoft iOS Forensic Toolkit provides forensic access to encrypted information stored in popular Apple devices running iOS, offering file system imaging and keychain extraction from the latest generations of iOS devices. By performing low-level extraction of the device, the Toolkit offers instant access to all protected information including SMS and email messages, call history, contacts and organizer data, Web browsing history, voicemail and email accounts and settings, stored logins and passwords, geolocation history, conversations carried over all instant messaging apps, including the most secure ones such as Signal, Wickr, and Telegram, as well as all application-specific data saved in the device.

About ElcomSoft Co. Ltd.

Founded in 1990, ElcomSoft Co.Ltd. is a global industry-acknowledged expert in computer and mobile forensics providing tools, training, and consulting services to law enforcement, forensics, financial and intelligence agencies. ElcomSoft pioneered and patented numerous cryptography techniques, setting and exceeding expectations by consistently breaking the industry’s performance records. ElcomSoft is Microsoft Certified Partner, and Intel Software Premier Elite Partner.