Elcomsoft iOS Forensic Toolkit 8.21 adds support for automated DFU mode and automated screen shot capturing using a pre-programmed Raspberry Pi Pico board. In addition, the new release adds checkm8 extraction support for compatible devices running iOS 15.7.3-15.7.5 and 16.4-16.4.1.

Elcomsoft iOS Forensic Toolkit 8.21 brings two new features available by using a pre-programmed Raspberry Pi Pico board. The first feature allows experts to automate the switching of iPhone 8, iPhone 8 Plus, and iPhone X devices into DFU, greatly simplifying the process that otherwise requires a sequence of button presses with precise timings. Automatic DFU mode is indispensable when one has a device with broken buttons, which would otherwise require disassembly to be placed into DFU. This feature requires the use of a pre-programmed Raspberry Pi Pico device.

The second feature adds the ability to make long, scrollable screen shots in a semi-automatic fashion. Available for all devices and versions of iOS, the new feature also makes use of the pre-programmed Raspberry Pi Pico device with custom, ElcomSoft-developed software that is now included with iOS Forensic Toolkit.

Capturing screenshots can be a crucial step in mobile device investigations. By taking a series of screenshots of what is displayed on a connected iOS device, investigators can gather digital evidence that may not be accessible through other means, such as advanced logical acquisition, where the data such as protected chat histories may not be available. In a way, the new feature can be viewed as new extraction tool in addition to cloud, advanced logical, and low-level extraction methods.

Elcomsoft iOS Forensic Toolkit 8.21 release notes:

• checkm8: added support for iOS 15.7.3-15.7.5 and 16.4-16.4.1
• new feature: added auto-DFU feature for iPhone 8, iPhone 8 Plus and iPhone X (with Raspberry Pi Pico)
• new feature: added automated screen shot capture for all models and iOS versions (with Raspberry Pi Pico)
• minor bug fixes and improvements