Elcomsoft iOS Forensic Toolkit--Full file system extraction for iOS 16.0 - 16.3.1

The latest update to Elcomsoft's iOS Forensic Toolkit 8.30 (Mac) and 7.90 (Windows/Mac) brings great news for investigators and forensic professionals. We are excited to announce the low-level file system extraction support for compatible Apple devices running iOS/iPadOS 16.0 through 16.3.1. With full low-level extraction support for several builds of iOS 16, the new extraction method extends previously announced partial file system extraction support by enabling full access to the file system.

What’s it all about

The previously announced partial file system extraction mechanism has been refined, now delivering the full file system for many devices running all versions of iOS 16 through iOS/iPadOS 16.3.1. The updated extraction agent now supports these iOS builds on iPhone Xs/Xr and newer devices up to and including the iPhone 14/14 Pro range and M1/M2 based iPads, while older devices such as the iPhone 8/iPhone X rely on the checkm8 extraction process.

The current build does not support keychain decryption on iOS 16.0-16.3.1. We are at the final stage of development of a solution expanding the amount of extractable information, with keychain decryption and iOS 16.4 support planned for the next update. We remain committed to offering innovative solutions to digital forensic investigators worldwide.

Compatibility

Please refer to the following chart for details on the types of extraction supported on the different platforms: