Perform full file system and logical acquisition of iPhone, iPad and iPod Touch devices. Image device file system, extract device secrets (passwords, encryption keys and protected data) and decrypt the file system image.

- Full file system extraction and keychain decryption without a jailbreak (iPhone 5s - iPhone 12, iOS 9.0 - 14.3)
- Logical acquisition extracts backups, crash logs, media and shared files
- Passcode unlock and physical acquisition for legacy devices (iPhone 4, 5 and 5c)
- Extracts and decrypts protected keychain items
- Real-time file system acquisition
- Automatically disables screen lock for smooth, uninterrupted acquisition

Supports:
All generations of iPhone, iPad, iPad Pro and iPod Touch with and without jailbreak; Apple Watch and Apple TV 4 and 4K; all versions of iOS from iOS 7 to iOS 14.x

New Features:

iPhone 12 and iOS 14 - 14.3 support
Elcomsoft iOS Forensic Toolkit 7.0 brings low-level extraction support for the latest generation of Apple devices based on the A14 Bionic. This includes the entire range of iPhone 12 models running all versions of iOS 14 from the original iOS 14.0 all the way through iOS 14.3. During the extraction, iOS Forensic Toolkit images the iPhone file system and pulls and decrypts the keychain, which in turn stores the user's passwords, certificates, authentication tokens and keys.

Passcode unlock and support for legacy devices: iPhone 4, 5 and 5c
Passcode unlock and full physical acquisition support are now available for legacy iPhone models - albeit only in the Mac edition of iOS Forensic Toolkit. The Toolkit can now unlock and image iPhone 4, 5 and 5c devices protected with an unknown screen lock passcode. This requires a macOS computer and a standard USB to Lightning cable (no Type-C cables, but you can use the adapter if your Mac has nothing but Type-C ports). Full physical acquisition is available for legacy iOS devices including the iPhone 4, 5 and 5c. For all supported models, the Toolkit can extract the bit-precise image of the user partition and decrypt the keychain.

Forensic Access to iPhone/iPad/iPod Devices running Apple iOS
Perform the complete forensic acquisition of user data stored in iPhone/iPad/iPod devices. Elcomsoft iOS Forensic Toolkit allows imaging devices' file systems, extracting device secrets (passcodes, passwords, and encryption keys) and accessing locked devices via lockdown records.

Full File System Extraction and Keychain Decryption Without a Jailbreak
iOS Forensic Toolkit fully supports the extraction of all jailbroken devices for which a jailbreak is available. Full file system extraction and keychain decryption are available for jailbroken devices. All public jailbreaks are supported.

Unlock and Imaging of Legacy Devices: iPhone 4, 5, and 5c
Passcode unlock and imaging support are available for legacy iPhone models. The Toolkit can be used to unlock encrypted iPhone 4, 5 and 5c devices protected with an unknown screen lock passcode by attempting to recover the original 4-digit or 6-digit PIN. This DFU attack works at the speed of 13.6 passcodes per second on iPhone 5 and 5c devices, and takes only 12 minutes to unlock an iPhone protected with a 4-digit PINs. 6-digit PINs will take up to 21 hours.

Extended Logical Acquisition
iOS Forensic Toolkit supports logical acquisition, a simpler and safer acquisition method compared to physical. Logical acquisition produces a standard iTunes-style backup of information stored in the device, pulls media and shared files and extracts system crash logs. While logical acquisition returns less information than physical, experts are recommended to create a logical backup of the device before attempting more invasive acquisition techniques.
Release Notes
- Added support for Apple devices running iOS 14.0 through 14.3 via extraction agent (full file system and keychain)

- Added support for A14 Bionic devices (full iPhone 12 range and iPad Air 4th generation)
- Gapless jailbreak-free extraction coverage for all devices running iOS 9.0 through 14.3
- Minor bug fixes and improvements

Compatible Devices and Platforms:
- 64-bit iOS devices with jailbreak: file system extraction, keychain decryption
- Partial file system & keychain acquisition for BFU, locked and disabled iPhone models ranging from the iPhone 5s through iPhone X
- Apple TV 4 (cable connection) and Apple TV 4K (wireless connection through Xcode, Mac only)
- Apple Watch (all generations); requires a third-party IBUS adapter
- No jailbreak: agent-based extraction for supported devices; advanced logical acquisition for all other devices

Logical acquisition includes:
- Extended information about the device
- iTunes-format backup (includes many keychain items)
- List of installed apps
- Media files (even if the backup is password-protected)
- Shared files (even if the backup is password-protected)

System Requirements:
- Windows 7
- Windows 8
- Windows 8.1
- Windows 10

* The iOS Forensic Toolkit for Microsoft Windows requires the computer running 64 bit version of Windows 7, Windows 8/8.1 or Windows 10. Latest version of iTunes is required.