Exploring iPadOS, tvOS and audioOS 17 and 18 Devices: File System and Keychain Extraction🔈

The latest update to iOS Forensic Toolkit brought bootloader-level extraction to a bunch of old iPads, Apple TVs, and even the first-gen HomePod running OS versions 17 and 18. This enabled full file system and keychain extraction on a those older Apple devices that can still run these versions of the OS.

What’s new in the Elcomsoft iOS Forensic Toolkit 🖥

Speaking of iOS Forensic Toolkit 8.81, the update extends bootrom (checkm8) extraction to cover iPadOS, tvOS and audioOS builds from the latest major families (17 and 18) on a defined set of older devices, adding the ability to perform full file system dumps and decrypt the keychain.

More details in our article:
✍️https://blog.elcomsoft.com/2025/11/exploring-ipados-tvos-and-audioos-17-and-18-devices-file-system-and-keychain-extraction/

#EIFT #updating

iOS Forensic Toolkit 9.0: full unlocking and perfect acquisition support for iPhone 6/6 Plus and other Apple A8/A8X devices🔥

The latest update to Elcomsoft iOS Forensic Toolkit introduces full unlock and perfect acquisition capabilities for iPhone 6, iPhone 6 Plus, iPad Mini 4, iPad Air 2 and other A8/A8X devices, including on-device passcode recovery.

In addition, low-level extraction is now supported for Apple TV 4 (HD), Apple TV 4K (1st gen) and HomePod devices running tvOS/audioOS 26.

More information at the link 💡

#EIFT #updating

🆕Low-Level Extraction for iOS 17 and 18🆕

We’ve just update iOS Forensic Toolkit to version 10.0, significantly expanding its low-level extraction capabilities for both the extraction agent and bootloader-based methods🔴

⚡️ Previously, agent-based extraction was capped at iOS 16.6.1. This release finally covers the remainder of the iOS 16 branch, and adds support for the entire iOS 17 branch as well as iOS 18 through 18.7.1;
⚡️We have also expanded checkm8 support to cover all the latest OS updates pushed by Apple on devices susceptible to the exploit;
⚡️Finally, we improved extended logical acquisition support for iOS/iPadOS 26, now pulling significantly more shared data than before.

In this update we are making the following changes:

▪️For quite a while, agent-based extraction hit a hard wall at iOS 16.6.1. Newer releases required more powerful exploits, or more exactly, a chain of exploits.
With version 10.0, we finally put the pieces of the puzzle together. First, we’ve added support for the remaining iOS 16 builds, covering iOS 16.7 through 16.7.15. More importantly, the agent now supports the entire iOS 17 branch (17.0 to 17.7.8) and introduces support for a range of iOS 18 versions (18.0 to 18.7.1);

▪️Checkm8 support now includes iOS and iPadOS 15.8.7, iPadOS 16.7.15, and iPadOS 18.7.5. We also added support for iOS 16.8.8, though keep in mind the usual checkm8 limitations still apply. Finally, if you are extracting smart home or media hardware, we updated coverage for tvOS and audioOS to versions 26.3 and 26.4;

▪️We’ve added extended logical extraction support for iOS 26, including iOS 26.4, which delivers significant forensic value: this newly improved method can pull massive amounts of "shared files".

More information at the link 📎

#EIFT #update

🆕Low-Level Extraction for M-Series iPads🆕

With the release of iOS Forensic Toolkit 10.01 we are extending low-level extraction capabilities to Apple tablets running up to iPadOS 18.7.1.

This update brings our extraction agent to the latest hardware, supporting not just A-series but also M-series iPads⚡️

We have also implemented support for the distinct memory layout found in high-end 1TB and 2TB iPad Pro models equipped with 16GB of RAM, which required a targeted engineering approach to handle the structural differences.

There is also a practical advantage to examining Apple tablets: their extended hardware lifecycle👣

Tablets are typically kept in service much longer than smartphones, with users routinely skipping multiple hardware generations before upgrading. Because of this longer operational life, examiners have a higher probability of encountering an older device running an exploitable version of iPadOS. This directly increases the chances of successfully deploying an extraction agent to acquire the full file system and the decrypted keychain.

More information at the link📎

#EIFT #update

🆕New Security Features and Low-Level Extraction of iOS 26🆕

We updated iOS Forensic Toolkit, adding low-level extraction support for iOS 26 and 26.0.1 via the extraction agent.

This support is available for most iPhones and iPads compatible with the iOS 26 branch with a notable exception of the iPhone 17 range and M5-based iPads.

❓Why exactly are these devices exempt, and what else did Apple do to make iOS 26 tougher and more resistant? Let’s find out.

❗️Released on September 15, 2025, iOS 26 represents an important shift in mobile security. Apple made an attempt to transition the operating system’s defenses away from reactive software patching, anchoring it instead in hardware-enforced trust based on hardware-level memory safety and post-quantum encryption.

This shift establishes a framework designed to operate in highly sensitive environments. The underlying architecture is robust enough that devices running the iOS 26 branch are formally approved to process and store information classified up to the NATO Restricted level. Germany’s Federal Office for Information Security (BSI) evaluated and confirmed this certification.

And more information at the link📎

#EIFT

Using the Extraction Agent in 2026: Compatibility, Signing, Firewall, and Extraction Tips🎓

Over the years, we have published several articles about the extraction agent. However, the underlying technology changes quickly, and incremental changes often have significant cumulative effects. As a result, many of our older posts are no longer relevant and can be misleading if followed to the letter today🇷🇺

While last year’s recap, Installing and Troubleshooting the Extraction Agent (2025), remains a solid foundation for general setup, it does not account for the most recent hardware and software developments.

The agent is an in-house app that gets sideloaded directly onto the target device.

This article serves as the definitive point of reference, providing an up-to-date recap of everything you need to know about the extraction agent as of May 2026.

Let's talk about:

💡What is it?
💡Data Scope and Acquisition Benefits
💡May 2026: At a Glance
💡Supported Devices and OS Versions
💡Installation, Signing, and Network Isolation

More in our new article📎

#EIFT

🆕Bypassing Stolen Device Protection: Alternative Ways of Installing the Extraction Agent🆕

Stated plainly: iOS Forensic Toolkit can now get past Stolen Device Protection.

There is a catch, and it belongs up front: this is not a magic unlock, and anyone selling it as one is selling something.

🔥What we have built is a way to install the extraction agent without ever pairing the iPhone to the workstation over a USB port.
Because the most disruptive thing SDP does to a forensic workflow is place Face ID or Touch ID in front of that pairing step, bypassing the pairing step bypasses the gate.
You still need:
🟢the device passcode;
🟢a paid Apple Developer account;
🟢a device you are authorized to examine.

With those in hand, SDP is no longer the wall it was a month ago.

This is the solution promised in Forensic Implications of Apple Stolen Device Protection. The how – every command, in order – will appear in a separate technical write-up.

This piece covers what the method does, when you would reach for it, and whether it should concern anyone who is not an examiner.

More information at the link📎

#EIFT

Sideloading the extraction agent: a Stolen Device Protection workaround👤

A new update to iOS Forensic Toolkit is out.
The headline feature is an alternative installation method for the extraction agent – that is, deploying it onto an iPhone while bypassing the mandatory pairing requirement.
The agent can now be delivered across the network, which removes a number of limitations that came with the usual cable-based installation. One requirement up front: the device must already be unlocked – in other words, the passcode must be known. This method does not work with a fully locked iPhone.

☺️Why a new installation method was needed?

The reason is a feature called Stolen Device Protection (SDP), which we discussed in the previous article. It is designed for the situation where a phone ends up in someone else’s hands and that person also knows the passcode.
In this mode, certain actions require biometric authentication – the owner’s Face ID or Touch ID — with no option to confirm the operation by entering the passcode. The checks tighten when the device is away from familiar locations such as home or work, and in settings they can be enforced at all times, regardless of location.

❗️Previously this protection could only be enabled optionally, and it was rarely encountered. Starting with iOS 26.4, that has changed: Apple turns Stolen Device Protection on automatically. As a result, examiners increasingly run into devices that simply will not allow a USB connection to a new computer.

😊The alternative agent delivery methods solve this.

More information at the link📎

#EIFT #Tips

🆕Special macOS Firewall: Safe Sideloading of the EIFT Extraction Agent🆕

Elcomsoft iOS Forensic Toolkit begins low-level extraction by sideloading the extraction agent, and the agent will not run until the phone has completed one or two checks against Apple’s servers.

Network requests, on a phone that is evidence. That single requirement is why we have shipped three different firewalls over the past three years.
💡The newest one, EIFT Firewall, is a free macOS application and a direct replacement for the 2023 script!

Why the phone needs the internet at all?

The phone has to reach a small number of Apple hosts, one of which has a name that resolves to a different address every few minutes, and nothing else. Arranging exactly that is harder than it sounds.

More information at the link📎

#EIFT

🆕Low-Level Extraction of the Apple Watch S4/S5🆕

iOS Forensic Toolkit 10.11 adds bootloader-level extraction for the Apple Watch Series 4, the Apple Watch Series 5, and the second-generation Apple TV 4K.

▪️The method uses usbliter8, an exploit of the SecureROM, the read-only boot code in the chip. checkm8 works on Apple chips up to the A11 generation, while usbliter8 works on the generation after it.

The extraction procedure is forensically sound: the toolkit does all the work in the RAM, and never starts the operating system of the device. The toolkit never alters the content of the data partition, so if you do the extraction again, you get the same checksum.

usbliter8 requires a microcontroller board to apply, and you will need our specific firmware to flash the board. This is a one-time procedure; after flashing the board, you can use it for all subsequent extractions.

🗣This article gives the full procedure for each of the two Apple Watch devices.

More information at the link📎

#EIFT

🆕Low-Level Extraction the Apple TV 4K 2nd Generation🆕

We’ve added bootloader-level low-level extraction support for the second-generation Apple TV 4K ❤️ iOS Forensic Toolkit

💡While the older 4K model was compatible with the checkm8 exploit, the second-generation is based on a newer SoC that required a newer exploit, usbliter8.

The exploit requires a custom adapter that uses a microcontroller board with our custom firmware.

🗣What you need? Let's talk!

More information at the link📎

#EIFT

🆕Low-Level Extraction of the HomePod mini🆕

iOS Forensic Toolkit 10.12 extracts the full file system image and the decrypted keychain from yet another IoT device: Apple HomePod mini.

😀This is the first file system extraction of the device, the method uses the usbliter8 bootloader exploit and a custom adapter. This guide covers the hardware, the extraction and analysis steps.

Know your HomePod

Apple has shipped three HomePod models, each based on a different chip. Apple’s specifications do not list the processor; use the model identifier page and match it to the chip below:

🤩 HomePod (1st generation): A8.

🤩 HomePod mini: S5.

🤩 HomePod (2nd generation): S7.

🗣Let’s talk about why a forensic specialist needs to analyze a smart speaker and what will be required for that.

More information at the link📎

#EIFT #update