Bootloader-level extraction for 16.7.6 and 15.8.2

Elcomsoft iOS Forensic Toolkit 8.54 expands checkm8-based bootloader-level extraction of Apple mobile devices, adding support 16.7.6 and 15.8.2 to macOS and Linux editions of the tool, while adding full iOS 16 support in the Linux edition.

The update to Elcomsoft's iOS Forensic Toolkit 8.54 brings important under-the-hood improvements enabling full bootloader-level iOS 16 extraction support in the Linux edition of the tool. In addition, 16.7.6 and 15.8.2 checkm8 extractions are now supported in both macOS and Linux editions.

The latest update now offers gapless bootloader-level extraction support for all versions of iOS 15 and 16 up to and including iOS/iPadOS 16.7.6 on a wide range of devices susceptible to the checkm8 exploit. The old limitation for A11 iPhones (the iPhone 8, 8 Plus, and iPhone X) range remains: checkm8 extractions cannot be used on those iPhones if they are running any version of iOS 16 and had had a screen lock passcode on them at any time after initial setup.

The updated bootloader-level extraction method utilizes a fused file system, which enables full iOS 16 extraction support in the Linux edition, and significantly improves iOS 16 checkm8 extractions in macOS. The bootloader-level extraction method can extract sandboxed app data, system databases, all keychain records, and other information available in the file system.

This new update offers enhanced capabilities for forensic professionals, providing them with the ability to extract and analyze data from a wide range of Apple devices running all versions of iOS 16. With its expanded compatibility and comprehensive extraction features, Elcomsoft continues to offer one of the most powerful and efficient mobile forensic tools on the market.

Compatibility

Bootloader-based low-level extraction (full file system and keychain) is now available for a wider range of hardware and iOS builds. The bootloader-level extraction method supports Apple devices built with the A11 Bionic and older chips, which includes a wide range of iPhone, iPad, Apple TV, and HomePod devices.

iOS Forensic Toolkit 8.54 Release Notes