The latest update to Elcomsoft’s iOS Forensic Toolkit 8.30 (Mac) and 7.90 (Windows/Mac) brings great news for investigators and forensic professionals. We are excited to announce the low-level file system extraction support for compatible Apple devices running iOS/iPadOS 16.0 through 16.3.1. With full low-level extraction support for several builds of iOS 16, the new extraction method extends previously announced partial file system extraction support by enabling full access to the file system.
For the first time ever, full file system extraction becomes available on the iPhone 14 and 14 Pro range of devices and other iPhone and iPad models built with the A12 and newer chips, effectively covering the iPhone Xr/Xs through iPhone 14/Pro range and many corresponding iPads including those based on Apple M1 and M2 chips.
The latest update to Elcomsoft’s iOS Forensic Toolkit 8.30 and 7.90 brings exciting news for investigators and forensic professionals, making low-level file system extraction available for latest-generation iPhone and iPad devices including the current iPhone 14, iPhone 14 Plus, as well as iPhone 14 Pro and iPhone 14 Pro Max devices. Full file system extraction support is available for iOS 16.0 through 16.3.1, and supports a wide range of hardware, effectively covering all iPhone models from the iPhone Xs/Xr through iPhone 14 range, as well as many iPads, including those based on Apple M1 and M2 chips.
The new extraction method utilizes Elcomsoft proprietary extraction agent, enables full access to the file system and includes the ability to extract sandboxed app data, system databases and other information available in the file system. We are working on bringing full keychain decryption support, which is scheduled for one of upcoming releases. We are also working on iOS 16.4 support.