iOS Forensic Toolkit 2.50 Provides Forensic Extraction of Pictures and Videos from iOS Devices

iOS Forensic Toolkit is updated to support the extraction of media files from iOS devices running all versions of iOS. The ability to extract pictures and videos without making a local backup or accessing the cloud offers experts a forensically sound way of quickly accessing media files stored in iPhone and iPad devices. The Toolkit can extract media files from locked devices by using iTunes pairing records (lockdown files).

iOS Forensic Toolkit 2.50 adds the ability to extract media files (pictures and videos) from iPhone and iPad devices running all versions of iOS. In contrast to local backups that could be encrypted and may take a long time to produce, iOS Forensic Toolkit is now able to quickly extract images and video files from iOS devices regardless of other settings. In order to extract media files, the iPhone or iPad must be paired with the computer. iOS Forensic Toolkit allows using lockdown files (pairing records), thus enabling the extraction from devices that are locked with a passcode.

Pictures and videos may become essential evidence. Due to EXIF metadata, images shot with an iPhone can help investigators pinpoint the user’s location at a certain moment, building a track of the user’s whereabouts during the time period of interest.

If a backup is password-protected and the device is running a version of iOS that does not allow resetting backup passwords, accessing media files could be difficult.

While workarounds for extracting media files exist, most existing methods are time and labor-consuming or not forensically sound.
Elcomsoft iOS Forensic Toolkit 2.50 offers a fast, easy and forensically sound way for extracting photos and videos from iOS devices regardless of backup protection and iCloud Photo Library settings. All of the following types of data are now extracted: