Elcomsoft iOS Forensic Toolkit 6.0 offers direct, forensically sound extraction for Apple devices running all versions of iOS from iOS 11 through iOS 13.4.1 without a jailbreak. This release adds full file system extraction support for the latest iOS builds including iOS 13.3.1, 13.4, and 13.4.1 for the iPhone 6s, 7, 8, X, Xr/Xs, 11, and 11 Pro generation devices (including the corresponding Plus and Max versions), as well as latest iPhone SE.

In Elcomsoft iOS Forensic Toolkit 6.0, we have once again expanded the range of compatible iOS devices supported by the new direct acquisition agent. The latest release plugs the gap of excepted and unsupported iOS releases, now covering the entire range of iOS versions from iOS 11 through the latest iOS 13.4.1 for all Apple device models from the iPhone 6s all the way up through the iPhone 11 range.

Newly added in this release is file system extraction support from iOS 13.3.1, 13.4, and 13.4.1 for the iPhone 6s, 7, 8, X, Xr/Xs, 11, 11 Pro and SE generation of devices without a jailbreak. At this time, keychain extraction is only available for iOS versions up to and including iOS 13.3. For iOS 13.3.1, 13.4, and 13.4.1 the extraction agent currently supports file system imaging.

Agent-based extraction utilizes a direct communication channel that does not require a jailbreak, becoming a forensically sound alternative to traditional acquisition methods. Based on direct access to the file system, agent-based extraction is safer, faster and more robust compared to jailbreak-based extraction, eliminating the risks and footprint associated with installing a third-party jailbreak. Our direct acquisition agent is safe to use, does not modify the system partition and does not remount the file system. Notably, the checkra1n jailbreak is not available for the A12-A13 generation of devices, which makes the extraction agent the only extraction method available for these latest-gen models.

Installing the agent requires the use of an Apple ID registered in Apple’s Developer Program. More about that in our blog article Why Mobile Forensic Specialists Need a Developer Account with Apple.

Release notes:

• Added support for jailbreak-free file system extraction for the iPhone 6s through iPhone 11 running iOS 13.3.1, 13.4, 13.4.1
• Bug fixes and performance improvements