Elcomsoft iOS Forensic Toolkit 6.10 delivers major improvements to jailbreak-based extraction, now offering keychain acquisition and file system extraction for iOS 13.5, 13.4.1, 13.4 and 13.3.1 with unc0ver v5, as well as keychain acquisition and file system extraction for iOS 13.5 and 13.5.1 with checkra1n. Jailbreak-based acquisition engine received a major overhaul, now offering greater than ever speed and stability.

In Elcomsoft iOS Forensic Toolkit 6.10, we have concentrated our efforts on supporting jailbreak-based extraction. The latest release plugs the gap of excepted and unsupported iOS releases, now offering keychain acquisition and file system extraction for iOS 13.5, 13.4.1, 13.4 and 13.3.1 with unc0ver v5, as well as keychain acquisition and file system extraction for iOS 13.5 with checkra1n. Moreover, file system and keychain extraction are available for iOS 13.5.1 and 13.5.5 beta for all devices compatible with the checkra1n jailbreak.

Newly added in this release are keychain acquisition for iOS 13.3.1, 13.4, 13.4.1 and 13.5 with unc0ver v5 jailbreak and keychain acquisition for iOS 13.5 and 13.5.1 with checkra1n. The ability to image the latest generation of devices running a very recent version of iOS is truly unprecedented.

Jailbreak-based extraction has been migrated to the new, overhauled engine. The new engine offers a major boost in performance, and is significantly more robust than the one it replaces.
One thing is missing from this release: we’ve got rid of the rootlessJB. But don’t you worry: everything from the rootlessJB was incorporated into our in-house acquisition agent, which supports the entire range of hardware and software combinations supported by the rootlessJB. Agent-based extraction is significantly more reliable and more forensically sound compared to even the rootless jailbreak.

Installing the agent requires the use of an Apple ID registered in Apple’s Developer Program. More about that in our blog article Why Mobile Forensic Specialists Need a Developer Account with Apple.

Release notes:

• Added keychain acquisition for iOS 13.5, 13.4.1, 13.4 and 13.3.1 with unc0ver v5 jailbreak
• Added keychain acquisition for iOS 13.5 with checkra1n jailbreak
• Improved general support for checkra1n jailbreak (iOS 12.3-13.5)
• Improved the speed and stability of keychain-based acquisition
• Removed rootlessJB support (agent-based acquisition is supported for the same range of iOS versions)
• Calculates time for agent-based extraction