Perfect Acquisition Part 4: The Practical Part

Welcome to Part 4 of the Perfect Acquisition series! In case you missed the other parts (1, 2, and 3), please check them out for more background information, or dive straight in and learn how to perform Perfect HFS Acquisition yourself. This section contains a comprehensive guide on how to perform the Perfect HFS Acquisition procedure.

👉 https://blog.elcomsoft.com/2023/04/perfect-acquisition-part-4-the-practical-part/

#ios #lowlevelextraction #eift #dfir #keychain

Elcomsoft iOS Forensic Toolkit 8.21 add auto-DFU and automated screen shot capture

Elcomsoft iOS Forensic Toolkit 8.21 adds support for automated DFU mode and automated screen shot capturing using a pre-programmed Raspberry Pi Pico board. In addition, the new release adds checkm8 extraction support for compatible devices running iOS 15.7.3-15.7.5.

👉 https://www.elcomsoft.com/news/833.html

#checkm8 #EIFT #DFU #mobileforensics #iOS #iPhone #DFIR

Automating DFU Mode with Raspberry Pi Pico

The latest update to iOS Forensic Toolkit brings two new features, both requiring the use of a Raspberry Pi Pico board. The first feature automates the switching of iPhone 8, iPhone 8 Plus, and iPhone X devices into DFU, while the second feature adds the ability to make long, scrollable screen shots in a semi-automatic fashion. In this article we will show how to build, program, and use a Raspberry Pi Pico board to automate DFU mode.

👉 https://blog.elcomsoft.com/2023/04/automating-dfu-mode-with-raspberry-pi-pico/

#DFU #EIFT #iOS #Raspberry #raspberrypipico #DFIR

Automating Scrolling Screenshots with Raspberry Pi Pico

The recent update to iOS Forensic Toolkit brought two automations based on the Raspberry Pi Pico board. One of the new automations makes it possible to make long, scrollable screen shots in a semi-automatic fashion. In this article we will show how to build, program, and use a Raspberry Pi Pico board to automate scrolling screenshots.

👉 https://blog.elcomsoft.com/2023/04/automating-scrolling-screenshots-with-raspberry-pi-pico/

#EIFT #iOS #logicalacquisition #Raspberry #raspberrypipico #screenshot #screenshot #dfir

Full low-level extraction for the entire iOS 15 range

Elcomsoft iOS Forensic Toolkit 8.22 and 7.81 expand low-level extraction support, now covering the entire iOS/iPadOS 15 range. The newly supported OS versions include 15.6 through 15.7.2. The new method enables the extraction of the full file system including keychain, and supports devices built with the A12 and newer chips, effectively covering the iPhone 8/X through iPhone 13 range, and many iPads including those based on Apple M1 chips.

👉https://www.elcomsoft.com/news/834.html

#EIFT #ios #dfir #mobileforensics

Low-level Extraction for iOS 15

Last month, we introduced a new low-level mechanism, which enabled access to parts of the file system from many Apple devices. The partial extraction process relies on a weak exploit that did not allow full sandbox escape. Today, the limitations are gone, and we are proud to offer the full file system extraction and keychain decryption for the entire iOS 15 range up to and including iOS/iPadOS 15.7.2.

👉 https://blog.elcomsoft.com/2023/05/low-level-extraction-for-ios-15/

#iOS #EIFT #agentextractor #dfir #mobileforensics

checkm8 extraction for iOS 15.7.6 and 16.5

Elcomsoft iOS Forensic Toolkit 8.23 expands bootloader-level checkm8-based extraction support, adding support for the latest available iOS 15 and 16 builds. The newly supported OS versions include iOS/iPadOS/tvOS 15.7.6 and 16.5. Thanks to the expanded range of supported OS versions, the tool now supports the full range of of iOS 15 and 16 builds on checkm8-vulnerable devices.

👉 https://www.elcomsoft.com/news/838.html

#EIFT #checkm8 #iOS #dfir #mobileforensic

Low-level extraction supported for last-gen iPhones with iOS 16

Elcomsoft iOS Forensic Toolkit 8.30 and 7.90 expand low-level extraction support, now covering iOS 16.0 through 16.3.1 on latest-generation iPhone and iPad models. For the first time ever, full file system extraction becomes available on the iPhone 14 and 14 Pro range of devices and other iPhone and iPad models built with the A12 and newer chips, effectively covering the iPhone Xr/Xs through iPhone 14/Pro range and many corresponding iPads including those based on Apple M1 and M2 chips.

👉 https://www.elcomsoft.com/news/839.html

#iphone #iOS #ipad #EIFT #mobileforensic #dataextraction #ElcomsoftAgent #agent

Low-level Extraction for iOS 16 with iPhone 14/14 Pro Support

A while ago, we introduced an innovative mechanism that enabled access to parts of the file system for latest-generation Apple devices. The process we called “partial extraction” relied on a weak exploit that, at the time, did not allow a full sandbox escape. We’ve been working to improve the process, slowly lifting the “partial” tag from iOS 15 devices. Today, we are introducing a new, enhanced low-level extraction mechanism that enables full file system extraction for the iOS 16 through 16.3.1 on all devices based on Apple A12 Bionic and newer chips.

👉 https://blog.elcomsoft.com/2023/06/low-level-extraction-for-ios-16-with-iphone-14-14-pro-support/

#agent #EIFT #Elcomsoft #iOS #iOS16 #dfir #mobileforensics

Low-level extraction support for iOS 16.5

Elcomsoft iOS Forensic Toolkit 8.40 and 7.94 expand agent-based low-level extraction of Apple mobile devices, adding support iOS 16.4.1, 16.4.1 (a), and 16.5 on A12 and newer chips, and supporting iOS 15.4 through 16.5 on A11 Bionic devices. In addition, checkm8-based extraction support was bumped to iOS/iPadOS/tvOS 16.6 and iOS/iPadOS 15.7.8.

👉 https://www.elcomsoft.com/news/843.html

#agent #EIFT #extractionagent #iOS #lowlevelextraction

Breaking into iOS 16.5: Extracting the File System and Keychain

When it comes to iOS data acquisition, Elcomsoft iOS Forensic Toolkit is the top choice for forensic experts. Its cutting-edge features and unmatched capabilities have made it the go-to software for investigating iOS devices. In a recent update, we expanded the capabilities of the low-level extraction agent to support full file system extraction and keychain decryption on Apple’s newest devices running iOS 16.5. This achievement represents a breakthrough, as the delay between Apple’s iOS updates and our forensic software release has significantly reduced.

👉 https://blog.elcomsoft.com/2023/08/breaking-into-ios-16-5-extracting-the-file-system-and-keychain/

#agent #EIFT #extractionagent #iOS #lowlevelextraction

iOS Forensic Toolkit: Troubleshooting Low-Level Extraction Agent

In this tutorial, we will address common issues faced by users of the iOS Forensic Toolkit when installing and using the low-level extraction agent for accessing the file system and keychain on iOS devices. This troubleshooting guide is based on the valuable feedback and data received by our technical support team.

👉 https://blog.elcomsoft.com/2023/09/ios-forensic-toolkit-troubleshooting-low-level-extraction-agent/

#EIFT #Agent #dataextraction #iOS

Elcomsoft iOS Forensic Toolkit 8.41: portable Windows edition 🔥

Elcomsoft iOS Forensic Toolkit 8.41 is now available for Windows users in the all-new Windows edition. This new update maintains and extends the functionality of EIFT 7, which is now approaching the end of its life cycle. EIFT 8 is provided as a portable edition, eliminating the need for installation. In addition, the updated extraction agent can now access individual folders or file system metadata.

👉 https://www.elcomsoft.com/news/844.html

#EIFT #Agent #dataextraction #iOS #Windows #MacOS

iOS Forensic Toolkit 8 Lands on Windows

We have exciting news: iOS Forensic Toolkit 8 is now available for Windows users in the all-new Windows edition. The new build maintains and extends the functionality of EIFT 7, which is now approaching the end of its life cycle. In addition, we’ve made the Toolkit portable, eliminating the need for installation.
Learn what’s new in the eights version of the Toolkit!

👉 https://blog.elcomsoft.com/2023/10/ios-forensic-toolkit-8-lands-on-windows/

#EIFT #Agent #dataextraction #iOS #Windows #MacOS

Using and Troubleshooting the checkm8 Exploit

The bootloader vulnerability affecting several generations of Apple devices opens the door to forensically sound extraction. In today’s article we’ll discuss the compatibility and features of this exploit with different devices, iOS versions, and platforms. In addition, we’ll provide security professionals and researchers with valuable insight into potential issues and solutions when working with checkm8.

👉 https://blog.elcomsoft.com/2023/10/using-and-troubleshooting-the-checkm8-exploit/

#checkm8 #EIFT #iOS #lowlevelextraction #troubleshooting

Elcomsoft iOS Forensic Toolkit 8.51: improved compatibility and enhanced functionality

The latest maintenance release of Elcomsoft iOS Forensic Toolkit 8.51 primarily focuses on addressing minor issues and introducing significant enhancements for older devices, particularly 32-bit devices with HFS filesystems. In addition, checkm8 extraction now supports iOS 16.7.3 and 16.7.4 where available.

👉🏻 https://www.elcomsoft.com/news/847.html

#agent #EIFT #iOS

A Comprehensive Instruction Manual on Installing the Extraction Agent

This guide covers the correct installation procedure for Elcomsoft low-level extraction agent, an integral part of iOS Forensic Toolkit that helps extracting the file system and keychain from supported iOS devices. This instruction manual provides a step-by-step guide for setting up a device and installing the extraction agent. We’ve included suggestions from troubleshooting scenarios and recommendations we derived during testing.

👉🏻 https://blog.elcomsoft.com/2023/12/a-comprehensive-instruction-manual-on-installing-the-extraction-agent/

#agent #EIFT #troubleshooting #iOS

Low-level extraction of iOS 16.6.1

Elcomsoft iOS Forensic Toolkit 8.52 expands agent-based low-level extraction of Apple mobile devices, adding support iOS 16.5.1, 16.6 and 16.6.1 on A11 Bionic and newer chips, and improving agent success rate for devices running iOS 15.0 through 16.5.

👉🏻 https://www.elcomsoft.com/news/848.html

#EIFT #iOS #iphone #dataextraction

Changes to U.S. iOS App Store Policies Allow External Purchase Links

In a controversial move, Apple is implementing major changes to its U.S. iOS App Store policies, granting developers the ability to direct customers to non-App Store purchasing options for digital goods. This update permits users to make in-app purchases through an alternative method. However, Apple will continue to collect a commission ranging from 12 to 27 percent on content purchased through this avenue, providing only a 3 percentage points commission cut compared to purchases made through the official Apple App Store.

👉🏻 https://blog.elcomsoft.com/2024/01/changes-to-u-s-ios-app-store-policies-allow-external-purchase-links/

#AppStore #Apple #news #iOS

Enhanced support for legacy devices

Elcomsoft iOS Forensic Toolkit 8.53 enhances support for legacy Apple devices, adding the ability to mount HFS images in Windows. In addition, the update brings multiple fixes in HFS extractions and general reliability enhancements.

👉🏻 https://www.elcomsoft.com/news/850.html

#EIFT #iOS