ElcomSoft iOS Forensic Toolkit

Overview of ElcomSoft iOS Forensic Toolkit (Perform physical and logical acquisition of IOS)

Perform the complete forensic acquisition of user data stored in iPhone/iPad/iPod devices. Elcomsoft iOS Forensic Toolkit allows imaging devices’ file systems, extracting device secrets (passcodes, passwords, and encryption keys) and accessing locked devices via lockdown records. Elcomsoft iOS Forensic Toolkit supports jailbroken 64-bit devices (iPhone 5s through iPhone X) running most versions of iOS 7 through 11.

In addition to media files, iOS Forensic Toolkit can extract stored files of multiple apps, extracting crucial evidence without a jailbreak. Extract Adobe Reader and Microsoft Office locally stored documents, MiniKeePass password database, and a lot more. The extraction requires an unlocked device or a non-expired lockdown record.

Overview of ElcomSoft iOS Forensic Toolkit 6 Features

- Physical acquisition for 64-bit iOS devices via jailbreak

- Logical acquisition extracts backups, crash logs, media and shared files

- iOS devices with pairing records (lockdown files)

- Extracts and decrypts protected keychain items

- Real-time file system acquisition

- Automatically disables screen lock for smooth, uninterrupted acquisition

Compatible Devices and Platforms:

• iPhone 5 and 5c: passcode unlock via DFU (macOS edition only)
• 64-bit iOS devices with jailbreak: file system extraction, keychain decryption
• Partial file system & keychain acquisition for BFU, locked and disabled iPhone models ranging from the iPhone 5s through iPhone X
• Apple TV 4 (cable connection) and Apple TV 4K (wireless connection through Xcode, Mac only)
• Apple Watch (all generations); requires a third-party IBUS adapter
• No jailbreak: agent-based extraction for supported devices; advanced logical acquisition for all other devices

All Features and Benefits of ElcomSoft iOS Forensic Toolkit

- Physical Acquisition for 32-bit and 64-bit iOS Devices

- Logical Acquisition with Lockdown Support and Keychain Extraction

- Access More Information than Available in iPhone Backups

- Keychain Recovery

- Passcode Recovery

System Requirements:

Windows: Windows Server 2016, Windows Server 2012, Windows 7 (32 bit), Windows 7 (64 bit), Windows 8, Windows 8.1, Windows 10

Supports: all generations of iPhone, iPad and iPod Touch with and without jailbreak; all versions of iOS from iOS 7 to iOS 11; logical acquisition (up to iOS 12.1) with no passcode using a pairing record.