Step by Step Guide to iOS Jailbreaking and Physical Acquisition

The procedure of installing a jailbreak for the purpose of physical extraction is vastly different from jailbreaking for research or other purposes. In particular, forensic experts are struggling to keep devices offline in order to prevent data leaks, unwanted synchronization and issues with remote device management.

👉 https://blog.elcomsoft.com/2019/05/step-by-step-guide-to-ios-jailbreaking-and-physical-acquisition/

#jb #jailbreak #ios #mobileforensics #dataextraction #iphone #keychain #forensictoolkit #password #filesystem #elcomsoft #ios12 #grayshift

Apple TV Forensics 03: Analysis

This post continues the series of articles about Apple companion devices. If you haven’t seen them, you may want to read Apple TV and Apple Watch Forensics 01: Acquisition first. If you are into Apple Watch forensics, have a look at Apple Watch Forensics 02: Analysis as well. Today we’ll have a look at what’s inside of the Apple TV.

A recent market analysis shows that Apple has sold more than 13 million Apple TV devices worldwide since 2016. Since 2007, Apple manufactured 6 different Apple TV models.

Read the complete article 👉 https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/

#ios #appletv #security #forensics #chimera #elcomsoft #filesystem #tvos #jailbreak

Elcomsoft iOS Forensic Toolkit 5.10 is updated to support physical acquisition of Apple devices running iOS 12.2 and 12.4. The Toolkit enables file system extraction for all devices supported by unc0ver and Chimera jailbreaks including the iPhone Xr and iPhone Xs. In addition, the Toolkit allows decrypting the keychain to extract stored passwords and authentication credentials (with the exception of A12/A12X devices).

👉 https://www.elcomsoft.com/news/725.html

#iOS #toolkit #iphone #jailbreak #chimera #unc0ver #jb #iOS12.4 #filesystem #passwords #keychain #decryption #mobileforensics #dfir

iOS Forensic Toolkit 5.50: iPhone extraction simplified

Elcomsoft iOS Forensic Toolkit 5.50 features a new communication channel empowering the tool’s acquisition engine. The newly designed communication channel offers faster and more robust extractions and simplifies the acquisition process by removing the need of disabling wireless connectivity.

👉 https://www.elcomsoft.com/news/745.html

📝 EIFT Release Notes

#iphone #ios #dataextraction #elcomsoftagent #toolkit #iOS13.5 #mobileforensics #mobilesecurity #filesystem #keychain

iOS Forensic Toolkit 6.20: filling the gaps

Elcomsoft iOS Forensic Toolkit 6.20 fills the gaps for jailbreak-free extraction of previously unsupported versions of iOS. The new release expands the availability of the extraction agent all the way back to the original iOS 10.0, while adding compatibility for previously unsupported versions of iOS 12 on the iPhone 5s and 6.

👉 https://www.elcomsoft.com/news/751.html

📝 Get Release Notes in PDF

#eift #mobileforensics #dfir #keychain #filesystem #iphone #dataextraction #ios

iOS Extraction Without a Jailbreak: Full iOS 9 Support, Simplified File System Extraction

We updated iOS Forensic Toolkit to bring two notable improvements. The first one is the new acquisition option for jailbreak-free extractions. The new extraction mode helps experts save time and disk space by pulling only the content of the user partition while leaving the static system partition behind. The second update expands jailbreak-free extraction all the way back to iOS 9, now supporting all 64-bit devices running all builds of iOS 9.

👉 https://blog.elcomsoft.com/2020/08/ios-extraction-without-a-jailbreak-full-ios-9-support-simplified-file-system-extraction/

#ios #iphone #mobileforensics #dfir #ios9 #filesystem #dataextraction #agent

The File System Dirty Bit

In older iPhones, the ‘file system dirty’ flag indicates unclean device shutdown, which affects the ability to perform bootloader-level extractions of Apple devices running legacy versions of iOS (prior to iOS 10.3 released in March 2017). As such, the “file system dirty” flag must be cleared before the extraction. In this article we discuss the very different forensic implications of this flag if it is set on the Data or System partitions.

👉 https://blog.elcomsoft.com/2021/05/the-file-system-dirty-bit/

#iphone #ios #mobileforensics #filesystem

iOS Forensic Toolkit 7.02 simplifies macOS installations, fixes corrupted file system extraction

Elcomsoft iOS Forensic Toolkit 7.02 is a minor update making it easier to install the tool on macOS computers and introducing a new agent extraction option to fix the extraction of corrupted file systems.

👉 https://www.elcomsoft.com/news/791.html

#ios #mobileforensics #macOS #filesystem

Updated Elcomsoft iOS Forensic Toolkit Simplifies macOS Installs, Fixes Corrupted File System Extraction

While we are still working on the new version of Elcomsoft iOS Forensic Toolkit featuring forensically sound and nearly 100% compatible checkm8 extraction, an intermediate update is available with two minor yet important improvements. The update makes it easier to install the tool on macOS computers, and introduces a new agent extraction option.

👉 https://blog.elcomsoft.com/2021/07/updated-elcomsoft-ios-forensic-toolkit-simplifies-macos-installs-fixes-corrupted-file-system-extraction/

#ios #mobileforensics #macOS #filesystem

Full File System and Keychain Acquisition: What, When, and How

We often write about full file system acquisition, yet we rarely explain what it is, when you can do it, and which methods you can use. We decided to clarify low-level extraction of Apple mobile devices (iPhones and iPads, and some other IoT devices such as Apple TVs and Apple Watches).

👉 https://blog.elcomsoft.com/2022/06/full-file-system-and-keychain-acquisition-what-when-and-how/

#filesystem #ios #eift #checkm8 #dfir #agent

Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds iOS 15.6 RC support

Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds forensically sound checkm8-based low-level extraction support for the latest iOS, iPadOS and tvOS 15.6 RC, while also supporting watchOS 8.7 RC. In addition, several fixes are made to the checkm8 extraction engine.

👉 https://www.elcomsoft.com/news/817.html

#eift #dfir #tvos #watchos #checkm8 #filesystem #keychain