Elcomsoft iOS Forensic Toolkit 7.30 brings the ability to perform low-level file system extraction for iPhone models up to the iPhone 13 Pro Max running iOS 15.1.1. The still-in-beta iOS Forensic Toolkit 8.0 receives the same features, and adds checkm8 acquisition support for iPhone 6s, SE, 7, 8, and iPhone X devices running iOS 15.4 and iOS 15.4.1.

Elcomsoft iOS Forensic Toolkit 7.30 brings low-level file system extraction support for multiple generations of Apple devices ranging all the way from the iPhone 8 and iPhone X through the iPhone 13 Pro Max. For these devices, the updated toolkit now covers the entire range of iOS releases since iOS 9.0 all the way up to iOS 15.1.1 with some exclusions (please refer to the compatibility matrix below). All 64-bit iPhone models capable of running iOS 15 are supported, including the iPhone 8/8 Plus, iPhone X, Xr, Xs, Xs Max, all the way up to the iPhone 13 generation. Learn how to sideload the extraction agent from our blog article.

The low-level extraction approach relies on the acquisition agent, which enables low-level access to the phone’s data and extracts the complete file system image. Keychain decryption is available on some versions of iOS. Please refer to the following chart for details on the types of extraction supported on the different platforms:

In addition, we updated the still-in-beta iOS Forensic Toolkit 8.0. The sixth beta receives the same features as Elcomsoft iOS Forensic Toolkit 7.30, and adds checkm8 acquisition support for iPhone 6s, SE, 7, 8, and iPhone X devices running iOS 15.4 and iOS 15.4.1. We’ve made multiple improvements to the checkm8 extraction process to make it significantly more reliable compared to the previous beta.

iOS Forensic Toolkit 7.30 release notes:

• Added agent acquisition support for iOS 15.1.1 (iPhone 8/X to iPhone 13 Pro Max)

iOS Forensic Toolkit 8.0 beta 6 release notes:

• Added agent acquisition support for iOS 15.1.1 (iPhone 8/X to iPhone 13 Pro Max)
• Added checkm8 acquisition support for iOS 15.4 and iOS 15.4.1 (iPhone 6s, SE, 7, 8, X)
• Multiple checkm8 fixes and improvements