Elcomsoft iOS Forensic Toolkit 6.20 fills the gaps for jailbreak-free extraction of previously unsupported versions of iOS. The new release expands the availability of the extraction agent all the way back to the original iOS 10.0, while adding compatibility for previously unsupported versions of iOS 12 on the iPhone 5s and 6.

In Elcomsoft iOS Forensic Toolkit 6.20, we have concentrated our efforts on supporting jailbreak-based extraction. The latest release plugs the gap of excepted and unsupported iOS releases, now offering full keychain decryption and file system extraction support without a jailbreak for systems as old as iOS 10.0 running on any supported hardware.

Originally released in September 2016, iOS 10 was regularly updated for most devices until July 2017. The 64-bit iPhones capable of running iOS 10 range from the iPhone 5s to iPhone 7 and 7 Plus. While one is hardly likely to encounter an iOS 10 in the wild, forensic labs still process devices running the older version of the OS. In this update, we’ve brought support for jailbreak-free extraction back to the roots, adding support for the oldest version of iOS capable of running on the iPhone 7 generation of devices.

In addition, we were able to add limited support for the previously unsupported versions of iOS 12 running on the iPhone 5s and 6 devices. For these versions of iOS, Elcomsoft iOS Forensic Toolkit can extract the file system image.

Finally, we have expanded support for the Apple TV devices, now offering keychain decryption in addition to file system extraction for both Apple TV 4 (Apple TV HD) and Apple TV 4K running tvOS 13.4 through 13.4.5. The acquisition is made possible with unc0ver jailbreak; more on that in our blog article Jailbreaking Apple TV 4K.

Installing the agent requires the use of an Apple ID registered in Apple’s Developer Program. More about that in our blog article Why Mobile Forensic Specialists Need a Developer Account with Apple.

Release notes:

• Added support for keychain acquisition for Apple TV 4 & 4K running tvOS 13.4 to 13.4.5
• Added full file system and keychain acquisition for iOS 10 (no jailbreak, agent-based)
• Added support for iPhone 5s and iPhone 6 running previously unsupported versions of iOS 12 (no jailbreak, agent-based); file system only