Why Mobile Forensic Specialists Need a Developer Account with Apple

In our recent article iPhone Acquisition Without a Jailbreak I mentioned that agent-based extraction requires the use of an Apple ID that has been registered in Apple’s Developer Program. Participation is not free and comes with a number of limitations. Why do you need to become a “developer”, what are the limitations, and is there a workaround? Read along to find out.

👉 https://blog.elcomsoft.com/2020/03/why-mobile-forensic-specialists-need-a-developer-account-with-apple/

by Oleg Afonin

#dfir #iOS13 #iphone #mobileforensics #iOS #keychain #jailbreak #EIFT #dataextraction #ElcomsoftAgent #apple

iOS Forensic Toolkit 5.40: jailbreak-free extraction for iOS 11-13.3

Elcomsoft iOS Forensic Toolkit 5.40 offers direct, forensically sound extraction for Apple devices running all versions of iOS from iOS 11 through iOS 13.3. Agent-based acquisition provides full file system extraction and keychain decryption without a jailbreak and literally no footprint.

👉 https://www.elcomsoft.com/news/736.html

#dfir #iOS13 #iphone #mobileforensics #iOS #keychain #jailbreak #EIFT #dataextraction #ElcomsoftAgent #apple

ElcomSoft Phone Breaker 9.50 fixes iCloud access, upgrades Home licenses to Pro

Elcomsoft Phone Breaker 9.50 fixes access to iCloud accounts protected with two-factor authentication, supports keychain data extracted with Cellebrite software, and enables the extraction of Apple Map data protected with end-to-end encryption. In addition, we deprecated the Home edition; existing non-expired licenses automatically upgraded to the Professional edition.

👉 https://www.elcomsoft.com/news/738.html

Download Elcomsooft Phone Breaker 9.50

#smartphone #iphone #icloud #keychain #messages #applehealth #screentime #maps #dataprotection #dataextraction #dataaccess

iOS acquisition methods compared: logical, full file system and iCloud

The iPhone is one of the most popular smartphone device. Thanks to its huge popularity, the iPhone gets a lot of attention from the forensic community. Multiple acquisition methods exist, allowing forensic users to obtain more or less information with more or less efforts. Some of these acquisition methods are based on undocumented exploits and public jailbreaks, while some other methods utilize published APIs to access information. In this article, we’ll compare the types and amounts of data one can extract from the same 256-GB iPhone 11 Pro Max using three different acquisition methods: advanced logical, full file system and iCloud extraction.

👉 https://blog.elcomsoft.com/2020/04/ios-acquisition-methods-compared-logical-full-file-system-and-icloud/

by Vladimir Katalov

#iOS #security #iphone #macOS #macbook #applewatch #ipad #smartphone #icloud #keychain #dataextraction #dataaccess #apple

iOS Forensic Toolkit 5.50: iPhone extraction simplified

Elcomsoft iOS Forensic Toolkit 5.50 features a new communication channel empowering the tool’s acquisition engine. The newly designed communication channel offers faster and more robust extractions and simplifies the acquisition process by removing the need of disabling wireless connectivity.

👉 https://www.elcomsoft.com/news/745.html

📝 EIFT Release Notes

#iphone #ios #dataextraction #elcomsoftagent #toolkit #iOS13.5 #mobileforensics #mobilesecurity #filesystem #keychain

Elcomsoft iOS Forensic Toolkit 6.10: jailbreaking all the way

Elcomsoft iOS Forensic Toolkit 6.10 delivers major improvements to jailbreak-based extraction, now offering keychain acquisition and file system extraction for iOS 13.5, 13.4.1, 13.4 and 13.3.1 with unc0ver v5, as well as keychain acquisition and file system extraction for iOS 13.5 and 13.5.1 with checkra1n. Jailbreak-based acquisition engine received a major overhaul, now offering greater than ever speed and stability.

👉 https://www.elcomsoft.com/news/749.html

#jailbreak #iphone #itsecurity #unc0ver #checkra1n #keychain #mobilesecurity #dfir #mobileforensics

ElcomSoft Phone Breaker 9.60 and Elcomsoft Phone Viewer 5.10 streamline iCloud data analysis

Elcomsoft Phone Breaker 9.60 streamlines access to iCloud data, breaking down the 17 types of iCloud synced data, the content of iCloud Drive and iCloud backups, into three large groups. By accessing the categories via three distinct groups, experts will be able to save time by analyzing the available information faster.

👉 https://www.elcomsoft.com/news/750.html

#ios #iphone #cloud #mobilesecurity #mobileforensics #keychain #cybersecurity #itsecurity

iOS Forensic Toolkit 6.20: filling the gaps

Elcomsoft iOS Forensic Toolkit 6.20 fills the gaps for jailbreak-free extraction of previously unsupported versions of iOS. The new release expands the availability of the extraction agent all the way back to the original iOS 10.0, while adding compatibility for previously unsupported versions of iOS 12 on the iPhone 5s and 6.

👉 https://www.elcomsoft.com/news/751.html

📝 Get Release Notes in PDF

#eift #mobileforensics #dfir #keychain #filesystem #iphone #dataextraction #ios

iOS, watchOS and tvOS Acquisition Methods Compared: Compatibility Notes

How can you obtain the highest amount of data from an iPhone, iPad, Apple TV or Apple Watch? This is not as simple as it may seem. Multiple overlapping extraction methods exist, and some of them are limited to specific versions of the OS. Let’s go through them and summarize their availability and benefits.

👉 https://blog.elcomsoft.com/2020/06/ios-watchos-and-tvos-acquisition-methods-compared-compatibility-notes/

#iOS #tvOS #watchOS #mobilesecurity #dfir #mobileforensics #cloud #keychain #dataaccess

Extracting and Decrypting iOS Keychain: Physical, Logical and Cloud Options Explored

The keychain is one of the hallmarks of the Apple ecosystem. Containing a plethora of sensitive information, the keychain is one of the best guarded parts of the walled garden. At the same time, the keychain is relatively underexplored by the forensic community. The common knowledge has it that the keychain contains the users’ logins and passwords, and possibly some payment card information. The common knowledge is missing the point: the keychain contains literally thousands of records belonging to various apps and the system that are required to access lots of other sensitive information. Let’s talk about the keychain, its content and its protection, and the methods used to extract, decrypt and analyze the various bits and pieces.

👉 https://blog.elcomsoft.com/2020/08/extracting-and-decrypting-ios-keychain-physical-logical-and-cloud-options-explored/

#ios #iphone #mobilesecurity #dfir #passwords #itsecurity #keychain

iOS Extraction Without a Jailbreak: Finally, Zero-Gap Coverage for iOS 9 through iOS 13.5 on All Devices

We have plugged the last gap in the range of iOS builds supported on the iPhone 5s and 6. The full file system extraction and keychain decryption is now possible on these devices regardless of the version of iOS they are running – at least if that’s iOS 9 or newer. For all other iOS devices up to and including the iPhone 11 Pro Max, we can extract them without a jailbreak if they are running iOS 9 through 13.5 without exceptions. Read how we made this possible.

👉 https://blog.elcomsoft.com/2020/10/ios-extraction-without-a-jailbreak-finally-zero-gap-coverage-for-ios-9-through-ios-13-5-on-all-devices/

#ios #iphone #agent #jailbreakfree #dataextraction #keychain #ipad

Keychain: the Gold Mine of Apple Mobile Devices

Keychain is an essential part of iOS and macOS that securely stores the most critical data: passwords of all kinds, encryption keys, certificates, credit card numbers, and more. Extracting and decrypting the keychain, when possible, is a must in mobile forensics. We seriously improved this part in the latest build of iOS Forensic Toolkit.

👉 https://blog.elcomsoft.com/2022/07/keychain-the-gold-mine-of-apple-mobile-devices/

#ios #apple #dfir #mobileforensics #keychain #agent

Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds iOS 15.6 RC support

Elcomsoft iOS Forensic Toolkit 8.0 beta 11 adds forensically sound checkm8-based low-level extraction support for the latest iOS, iPadOS and tvOS 15.6 RC, while also supporting watchOS 8.7 RC. In addition, several fixes are made to the checkm8 extraction engine.

👉 https://www.elcomsoft.com/news/817.html

#eift #dfir #tvos #watchos #checkm8 #filesystem #keychain

iOS 16: Extracting the File System and Keychain from A11 Devices

Bootloader-based acquisition is the only 100% forensically sound data extraction method for Apple devices. It is the only way to acquire the full set of data from those devices that run iOS 16, albeit with a huge caveat that makes the whole thing more of a brain exercise than a practical forensic tool. Let’s review the iOS 16 compatibility in iOS Forensic Toolkit and go through the whole process step by step.

👉 https://blog.elcomsoft.com/2022/09/ios-16-extracting-the-file-system-and-keychain-from-a11-devices/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain

iOS Forensic Toolkit 8.0 Now Official: Bootloader-Level Extraction for 76 Devices

iOS Forensic Toolkit 8.0 is officially released! Delivering forensically sound checkm8 extraction and a new command-line driven user experience, the new release becomes the most sophisticated mobile forensic tool we’ve released to date.

👉🏻 https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain

Elcomsoft iOS Forensic Toolkit 8.11 decrypts iOS 15.5 keychain

Elcomsoft iOS Forensic Toolkit 8.11 adds the ability to extract and decrypt the keychain from devices running all versions of iOS/iPadOS up to and including 15.5. The Windows edition is currently available in iOS Forensic Toolkit 7.71, which receives the same update.

🧑‍💻 https://www.elcomsoft.com/news/827.html

#ios #EIFT #mobileforensics #keychain #ios15

iOS 15.5 Low-Level Keychain Extraction

The updated iOS Forensic Toolkit 8.11 brings keychain decryption support to devices running iOS/iPadOS versions up to and including the 15.5 by using the extraction agent. The tool supports recent models that can run iOS 15 , which includes devices based on the Apple A12 through A15 Bionic, as well as Apple Silicon based devices built on the M1 SoC.

🧑‍💻 https://blog.elcomsoft.com/2023/01/ios-15-5-low-level-keychain-extraction/

#ios #EIFT #mobileforensics #keychain #ios15 #ipad #agent

Perfect Acquisition Part 4: The Practical Part

Welcome to Part 4 of the Perfect Acquisition series! In case you missed the other parts (1, 2, and 3), please check them out for more background information, or dive straight in and learn how to perform Perfect HFS Acquisition yourself. This section contains a comprehensive guide on how to perform the Perfect HFS Acquisition procedure.

👉 https://blog.elcomsoft.com/2023/04/perfect-acquisition-part-4-the-practical-part/

#ios #lowlevelextraction #eift #dfir #keychain

Comprehensive low-level extraction for last-gen iPhones with iOS 16.4

Elcomsoft iOS Forensic Toolkit 8.31 and 7.91 are once again pushing the boundaries of what is possible by enabling full low-level extraction support for iOS 16 devices up to and including iOS/iPadOS 16.4. Supported models include many recent and latest-generation iPhone and iPad models based on the Apple A12 Bionic and newer chips. For the first time ever, full file system extraction and keychain decryption become available on the iPhone 14 and 14 Pro range of devices, as well as many corresponding iPads including those based on Apple M1 and M2 chips.

👉 https://www.elcomsoft.com/news/840.html

#agent #EIFT #extractionagent #keychain #lowlevelextraction #ios16

Pushing the Boundaries: Low-Level Extraction of iOS 16.4 with Keychain Decryption

When it comes to iOS data acquisition, Elcomsoft iOS Forensic Toolkit stands head and shoulders above the competition. With its cutting-edge features and unmatched capabilities, the Toolkit has become the go-to software for forensic investigations on iOS devices. The recent update expanded the capabilities of the tool’s low-level extraction agent, adding keychain decryption support on Apple’s newest devices running iOS 16.0 through 16.4.

👉 https://blog.elcomsoft.com/2023/07/pushing-the-boundaries-low-level-extraction-of-ios-16-4-with-keychain-decryption/

#agent #EIFT #extractionagent #keychain #lowlevelextraction #ios16