Elcomsoft iOS Forensic Toolkit 6.52: plugging the last gap

Elcomsoft iOS Forensic Toolkit 6.52 fills the last gap for jailbreak-free extraction of previously unsupported versions of iOS. The new release expands the availability of the extraction agent, adding full file system and keychain decryption support for previously unsupported versions of iOS 12 on the iPhone 5s and 6.

In Elcomsoft iOS Forensic Toolkit 6.52, we have concentrated our efforts on supporting jailbreak-based extraction, filling the final spot in iOS 12 support. Since iOS 12.4.8 is the last version of iOS supported on the iPhone 5s and 6, there are no more excepted and unsupported iOS releases left within the entire range of operating systems on these devices. In addition, iOS Forensic Toolkit is now offering full keychain decryption and file system extraction support without a jailbreak for systems as old as iOS 9.0 through iOS 13.5 running on all Apple devices supporting these versions of iOS.

The result of this update is the complete, zero-gap coverage for iPhone 5s and iPhone 6 devices without a jailbreak from iOS 9 onwards, up to the last version of the system supported on this hardware. All other devices starting with the iPhone 6s through iPhone 11 Pro Max are also fully supported without a jailbreak if they are running any version of iOS between iOS 9.0 through iOS 13.5. For these devices, iOS Forensic Toolkit can pull the file system image, extract and decrypt the keychain in a forensically sound way and without the need to install a jailbreak.

Agent-based extraction offers numerous benefits compared to all other extraction methods. The agent does not make any changes to user data, offering forensically sound extraction without requiring Internet access on the device and without the risk of bricking.

Installing the agent requires the use of an Apple ID registered in Apple’s Developer Program. More about that in our blog article Why Mobile Forensic Specialists Need a Developer Account with Apple. A workaround exists, but is currently only available to Mac users; more details in the blog article.

Release notes: