Breaking and Securing Apple iCloud Accounts

The cloud becomes an ever more important (sometimes exclusive) source of the evidence whether you perform desktop or cloud forensics. Even if you are not in forensics, cloud access may help you access deleted or otherwise inaccessible data.

Let’s review all the possibilities of accessing Apple iCloud data with or without a password.

👉 https://blog.elcomsoft.com/2019/07/breaking-and-securing-apple-icloud-accounts/

#iCloud #iOS #forensocs #dfir #forensicsoftware #smartphone #encryption #2FA #toolkit #jailbreak #token #security #cloudsecurity #mobileforensics

Elcomsoft iOS Forensic Toolkit 5.10 is updated to support physical acquisition of Apple devices running iOS 12.2 and 12.4. The Toolkit enables file system extraction for all devices supported by unc0ver and Chimera jailbreaks including the iPhone Xr and iPhone Xs. In addition, the Toolkit allows decrypting the keychain to extract stored passwords and authentication credentials (with the exception of A12/A12X devices).

👉 https://www.elcomsoft.com/news/725.html

#iOS #toolkit #iphone #jailbreak #chimera #unc0ver #jb #iOS12.4 #filesystem #passwords #keychain #decryption #mobileforensics #dfir

iOS Acquisition on Windows: Tips&Tricks

When you perform Apple iCloud acquisition, it almost does not matter what platform to use, Windows or macOS (I say almost, because some differences still apply, as macOS has better/native iCloud support). Logical acquisition can be done on any platform as well. But when doing full file system acquisition of jailbroken devices using Elcomsoft iOS Forensic Toolkit, we strongly recommend using macOS. If you are strictly tied to Windows, however, there are some things you should know.

👉 https://blog.elcomsoft.com/2019/09/ios-acquisition-on-windows-tipstricks/

#ios #toolkit #windows #mobileforensics #decryption #shh #dmg

Installing and using iOS Forensic Toolkit on macOS 10.15 Catalina

The release of macOS Catalina brought the usual bunch of security updates. One of those new security features directly affects how you install Elcomsoft iOS Forensic Toolkit on Macs running the new OS. In this guide we’ll provide step by step instructions on installing and running iOS Forensic Toolkit on computers running macOS 10.15 Catalina. Note: on macOS Catalina, you must use iOS Forensic Toolkit 5.11 or newer (older versions may also work but not recommended).

👉 https://blog.elcomsoft.com/2019/10/installing-and-using-ios-forensic-toolkit-on-macos-catalina/

#Catalina #macOS #eift #toolkit #apple #update #upd #dataacquisition

iOS Device Acquisition with checkra1n Jailbreak

We’ve just announced a major update to iOS Forensic Toolkit, now supporting the full range of devices that can be exploited with the unpatchable checkra1n jailbreak. Why is the checkra1n jailbreak so important for the forensic community, and what new opportunities in acquiring Apple devices does it present to forensic experts? We’ll find out what types of data are available on both AFU (after first unlock) and BFU (before first unlock) devices, discuss the possibilities of acquiring locked iPhones, and provide instructions on installing the checkra1n jailbreak.

checkra1n is not about just the iPhones. We have recently tested checkra1n with Apple TV 4. Today is the day to try the new jailbreak with Apple’s bread-and-butter product, the iPhone...

👉 https://blog.elcomsoft.com/2019/11/ios-device-acquisition-with-checkra1n-jailbreak/

#checkra1n #jailbreak #jb #mobileforensics #eift #toolkit #ios #iPhone #exploit

iOS Forensic Toolkit 5.20 adds future-proof file system extraction support for Apple devices with checkra1n jailbreak

Elcomsoft iOS Forensic Toolkit 5.20 is updated with file system extraction support for select Apple devices running all versions of iOS from iOS 12 to iOS 13.3. Making use of the new future-proof bootrom exploit built into the checkra1n jailbreak, EIFT is able to extract the full file system image, decrypt passwords and authentication credentials stored in the iOS keychain.

👉 https://www.elcomsoft.com/news/728.html

#checkra1n #jailbreak #jb #mobileforensics #eift #toolkit #ios #iPhone #exploit #informationtechnology #computerscience #riskmanagement #imessage #privacy #pentest #bruteforce #passwordcracking #code #apple #innovation #security #digitalforensics #computercrime

Meet with us at Regional Digital and Cyber Investigation CPD Workshops in Bedfordshire Police HQ (covers Bedfordshire, Hertfordshire, Cambridgeshire, Norfolk, Suffolk and Kent forces) and learn more about New approaches and possibilities in data acquisition from iOS devices. 📲

This and other future events can be found here: https://www.elcomsoft.com/events.html

#jailbreak #unc0ver #iPhone #iOS #dataextraction #mobileforensic #eift #toolkit #ios #iPhone #privacy #security #digitalforensics #computercrime

iOS Forensic Toolkit 5.50: iPhone extraction simplified

Elcomsoft iOS Forensic Toolkit 5.50 features a new communication channel empowering the tool’s acquisition engine. The newly designed communication channel offers faster and more robust extractions and simplifies the acquisition process by removing the need of disabling wireless connectivity.

👉 https://www.elcomsoft.com/news/745.html

📝 EIFT Release Notes

#iphone #ios #dataextraction #elcomsoftagent #toolkit #iOS13.5 #mobileforensics #mobilesecurity #filesystem #keychain

Breaking the iPhone 12: Forensic Extraction of iOS 14 Devices

iOS Forensic Toolkit 7.0 brings low-level extraction support for the latest generation of Apple devices. This includes the entire range of iPhone 12 models as well as all other devices capable of running iOS 14.0 to 14.3. Learn how to image the latest iPhone models without a jailbreak.

👉 https://blog.elcomsoft.com/2021/03/breaking-the-iphone-12-forensic-extraction-of-ios-14-devices/

#mobileforensics #ios14 #iphone12 #agent #eift #toolkit

Elcomsoft iOS Forensic Toolkit 8.0 brings forensically sound bootloader-based extraction for select iPhone & iPad models

Elcomsoft iOS Forensic Toolkit 8.0 is a major release bringing support for repeatable, verifiable, and truly forensically sound bootloader-level extraction of 76 Apple devices ranging from the ancient iPhone 4 all the way up to the iPhone X, a large number of iPad, iPod Touch, Apple Watch, and Apple TV models, and featuring a refreshed, command-line driven user interface.

👉 https://www.elcomsoft.com/news/822.html

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16

iOS 16: Extracting the File System and Keychain from A11 Devices

Bootloader-based acquisition is the only 100% forensically sound data extraction method for Apple devices. It is the only way to acquire the full set of data from those devices that run iOS 16, albeit with a huge caveat that makes the whole thing more of a brain exercise than a practical forensic tool. Let’s review the iOS 16 compatibility in iOS Forensic Toolkit and go through the whole process step by step.

👉 https://blog.elcomsoft.com/2022/09/ios-16-extracting-the-file-system-and-keychain-from-a11-devices/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain

iOS Forensic Toolkit 8.0 Now Official: Bootloader-Level Extraction for 76 Devices

iOS Forensic Toolkit 8.0 is officially released! Delivering forensically sound checkm8 extraction and a new command-line driven user experience, the new release becomes the most sophisticated mobile forensic tool we’ve released to date.

👉🏻 https://blog.elcomsoft.com/2022/09/ios-forensic-toolkit-8-0-now-official-bootloader-level-extraction-for-76-devices/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #keychain

iOS 16: SEP Hardening, New Security Measures and Their Forensic Implications

iOS 16 brings many changes to mobile forensics. Users receive additional tools to control the sharing and protection of their personal information, while forensic experts will face tighter security measures. In this review, we’ll talk about the things in iOS 16 that are likely to affect the forensic workflow.

👉🏻 https://blog.elcomsoft.com/2022/09/ios-16-sep-hardening-new-security-measures-and-their-forensic-implications/

#eift8 #toolkit #apple #iphone #mobileforensic #dfir #ios16 #checkm8

checkm8 Extraction Cheat Sheet: iPhone and iPad Devices

The newly released iOS Forensic Toolkit 8.0 delivers forensically sound checkm8 extraction powered with a command-line interface. The new user experience offers full control over the extraction process, yet mastering the right workflow may become a challenge for those unfamiliar with command-line tools. In this quick-start guide we will lay out the steps required to perform a clean, forensically sound extraction of a compatible iPhone or iPad device.

👉 https://blog.elcomsoft.com/2022/11/checkm8-extraction-cheat-sheet-iphone-and-ipad-devices/

#eift #toolkit #checkm8 #ios16 #dfir #dfu #mobileforensics

Advanced Logical Extraction with iOS Forensic Toolkit 8: Cheat Sheet

Advanced logical acquisition is the most compatible and least complicated way to access essential evidence stored in Apple devices. In legacy versions of iOS Forensic Toolkit, we offered a 1-2-3 style, menu-driven extraction experience, while the updated release of iOS Forensic Toolkit 8.0 is driven by the command line. In this quick-start guide we will lay out the steps required to extract the most amount of data from Apple devices via the advanced logical process.

👉 https://blog.elcomsoft.com/2022/11/advanced-logical-extraction-with-ios-forensic-toolkit-8-cheat-sheet/

#eift #toolkit #ios #logicalacquisition #dfir #mobileforensics

Approaching iOS Extractions: Choosing the Right Acquisition Method

The extraction method or methods available for a particular iOS device depend on the device’s hardware platform and the installed version of iOS. While logical acquisition is available for all iOS and iPadOS devices, more advanced extraction methods are available for older platforms and versions of iOS. But what if more than one way to extract the data is available for a given device? In this guide, we’ll discuss the applicable acquisition methods as well as the order in which they should be used.

👉 https://blog.elcomsoft.com/2022/11/approaching-ios-extractions-choosing-the-right-acquisition-method/

#ios #checkm8 #agent #edpr #eift #toolkit #dfir #mobileforensics #dataextraction

iOS Forensic Toolkit 8.20 and 7.80 add partial file system extraction for iOS 16.1.2 and older

Elcomsoft iOS Forensic Toolkit 8.20 and 7.80 add low-level extraction support for a range of iOS versions, pulling parts of the file system. The newly supported iOS versions go all the way up to iOS 16.1.2. The new method supports devices built with the A11 through A16 Bionic chips, effectively covering the iPhone 8/X through iPhone 14 range, and supports many iPads including those based on Apple M1 and M2 chips.

👉 https://www.elcomsoft.com/news/831.html

#EIFT #iOS #agent #toolkit #dfir #mobileforensics

iOS Forensic Toolkit and Open Source

As a provider of mobile forensic tools, we at Elcomsoft strongly believe in giving back to the community. Our iOS Forensic Toolkit (EIFT) is a highly complex and powerful mobile acquisition tool, consisting of almost eighty sub-projects, many of which are open source. While we have benefited from the contributions of the community, we also believe that it’s time to contribute back to the open source community by publishing our changes to those projects as required by their permissive license.

👉 https://blog.elcomsoft.com/2023/05/ios-forensic-toolkit-and-open-source/

#EIFT #opensource #toolkit