iOS acquisition methods compared: logical, full file system and iCloud

The iPhone is one of the most popular smartphone device. Thanks to its huge popularity, the iPhone gets a lot of attention from the forensic community. Multiple acquisition methods exist, allowing forensic users to obtain more or less information with more or less efforts. Some of these acquisition methods are based on undocumented exploits and public jailbreaks, while some other methods utilize published APIs to access information. In this article, we’ll compare the types and amounts of data one can extract from the same 256-GB iPhone 11 Pro Max using three different acquisition methods: advanced logical, full file system and iCloud extraction.

👉 https://blog.elcomsoft.com/2020/04/ios-acquisition-methods-compared-logical-full-file-system-and-icloud/

by Vladimir Katalov

#iOS #security #iphone #macOS #macbook #applewatch #ipad #smartphone #icloud #keychain #dataextraction #dataaccess #apple

Apple Watch Forensics Reloaded

Is it possible to extract any data from an Apple Watch? It’s relatively easy if you have access to the iPhone the device is paired to, or if you have a backup of that iPhone. But what if the watch is all you have? If there is no paired iPhone, no backup and no iCloud credentials, how can you connect the Apple Watch to the computer, and can you backup the watch?

👉 https://blog.elcomsoft.com/2020/11/apple-watch-forensics-reloaded/

#ios #mobilesecurity #dfir #mobileforensics #applewatch

Apple Watch Forensics: The Adapters

How do you extract an Apple Watch? While several methods are available, none of them will work if you want to access the device directly without an adapter. There are several different options available on the market, some of them costing north of $200. We tested a large number of such adapters. How do they stand to the marketing claims? In this article, I will share my experience with these adapters.

👉 https://blog.elcomsoft.com/2021/08/apple-watch-forensics-the-adapters/

#applewatch #mobileforensics #dfir #iosforensictoolkit

Apple Watch Forensics: More on Adapters

If you are doing Apple Watch forensics, I’ve got some bad news for you. The latest model of Apple Watch, the Series 7, does not have a hidden diagnostics port anymore, which was replaced with a wireless 60.5GHz module (and the corresponding dock, which is nowhere to be found). What does that mean for the mobile forensics, and does it make the extraction more difficult? Let’s shed some light on it.

👉 https://blog.elcomsoft.com/2021/11/apple-watch-forensics-more-on-adapters/

#applewatch #ios #cloudsecurity #cloudforensics

iOS Forensic Toolkit 8 Apple Watch S3 checkm8 Extraction Cheat Sheet

checkm8 is the only extraction method available for the Apple Watch S3 allowing full access to essential evidence stored in the device. In this guide, we will talk about connecting the Apple Watch S3 to the computer, placing the watch into DFU mode, applying the checkm8 exploit and extracting the file system from the device with iOS Forensic Toolkit 8.0.

👉 https://blog.elcomsoft.com/2022/11/ios-forensic-toolkit-8-apple-watch-s3-checkm8-extraction-cheat-sheet/

#applewatch #checkm8 #eift #dfir

Elcomsoft iOS Forensic Toolkit 8.50 expands capabilities for Linux users and legacy devices

Elcomsoft iOS Forensic Toolkit 8.50 is now available for Linux users in the all-new Linux edition. This new update implements logical acquisition, as well as agent-based and bootloader-based low-level extraction methods in a single tool for common Linux distros. In addition, the update brings low-level extraction for Apple Watch S0, S1, and S2 and improves bootloader level extractions for all supported devices.

👉🏻 https://www.elcomsoft.com/news/846.html

#linux #applewatch #apple #EIFT #dfir

Forensic Insights into Apple Watch Data Extraction

The latest update to the iOS Forensic Toolkit has expanded data extraction support for older models of Apple Watch, introducing low-level extraction capabilities for Apple Watch Series 0, Series 1, and Series 2. In a landscape where new devices are released on a yearly schedule, we stand committed to a balanced approach. While it’s easy for many to dismiss older devices, we recognize their significance as they frequently reappear in the labs of forensic experts. It is important to emphasize that, unlike many, we cater to the needs of experts who have to deal with legacy devices. This enhancement enables macOS and Linux users to delve deeper into these watches, retrieving crucial information such as passwords and complete file systems.

👉🏻 https://blog.elcomsoft.com/2023/11/forensic-insights-into-apple-watch-data-extraction/

#applewatch #apple #EIFT #watchOS #dfir