iOS Forensic Toolkit 4.11 adds advanced logical acquisition support for a number of new devices including last-generation iPad Pro models and all generations of Apple Watch.

iOS Forensic Toolkit receives an update, adding advanced logical acquisition support for the latest range of Apple iPad and Apple Watch devices. Version 4.11 now supports the current range of iPad Pro devices including the iPad Pro 11 and iPad Pro 12.9 (2018). The advanced logical acquisition process obtains information available through iOS backup service, and additionally extracts extended device information, media files (photos and videos) regardless of backup password, as well as crash logs and shared files.

Supporting Apple Watch, iPad (2018), iPad Pro 11 and iPad Pro 12.9 (2018)

iOS Forensic Toolkit 4.11 now fully supports extended logical acquisition of Apple’s 2018 iPads. The newly added models include the two new Pro models, the iPad Pro 11 and 12.9 (2018) equipped with Apple A12X Bionic chip set.

In addition to last-generation iPad Pro devices, iOS Forensic Toolkit 4.11 adds logical extraction capability for complimentary Apple devices including all generations of Apple Watch. Since neither Apple Watch nor Apple TV offer iTunes-style backups, iOS Forensic Toolkit will extract available information such as media files, crash logs and general information about the device. Apple iTunes must be installed to perform the extraction. Experts will require a third-party IBUS adapter to make the connection.

Elcomsoft iOS Forensic Toolkit is the only third-party tool on the market to extract information from Apple Watch devices. Alternatively, experts may attempt to create an iTunes-style backup of the user’s iPhone paired with their Apple Watch. However, extracting information directly from the Watch allows accessing information even if the iPhone is locked or unavailable. While Apple Watch does not offer standalone iTunes-style backups, experts can still access crash logs and media files including EXIF and location data.

Apple TV devices also do not support iTune-style backups, but may contain a local copy of the user’s entire iCloud Photo Library (requires iCloud Photos enabled). Since Apple TV does not feature passcode protection, the extraction is possible even if the user’s iPhone is locked down and the iCloud password is unknown.
iOS Forensic Toolkit 4.11 is now providing all possible options for extracting and decrypting data from devices running the latest versions of iOS, WatchOS and TvOS, including the latest generations of Apple hardware.

Release notes:

• Added support for iPad Pro 11 and iPad Pro 12.9 (2018)
• Added support for all generations of Apple Watch (requires a third-party IBUS adapter)
• Added support for macOS Mojave