The second beta of Elcomsoft iOS Forensic Toolkit 8.0 for Mac is released, bringing forensically sound checkm8 extraction to iOS 15 devices and delivering a host of under-the-hood improvements and enhancements.

Elcomsoft iOS Forensic Toolkit 8.0 beta 2 for Mac improves what was originally done in the first beta, continuing to deliver forensically sound extraction of iPhone 5s, iPhone 6, 6 Plus, 6s, 6s Plus, and iPhone SE (1.Gen) devices with a known or empty screen lock passcode. Compared to the first beta, EIFT 8.0 b2 brings support for iOS 14 and 15 up to and including iOS 15.1, enabling bootloader-based, forensically sound extraction of supported devices running the latest available versions of iOS.

To preserve digital evidence, the chain of custody begins from the first point of data collection to ensure that digital evidence collected during the investigation remains court admissible. With Elcomsoft iOS Forensic Toolkit, we introduce a forensically sound extraction solution offering verifiable and repeatable results on subsequent extractions. When using iOS Forensic Toolkit on a supported device, the checksum of the first extracted image will match checksums of subsequent extractions provided that the device is powered off between extractions and never boots the installed version of iOS in the meantime.

The new extraction method is the cleanest yet. Our implementation of bootloader-based exploit is derived directly from the source. All the work is performed completely in the RAM, and the operating system installed on the device is left untouched and is not used during the boot process.

With this update, Elcomsoft iOS Forensic Toolkit becomes the most advanced iOS acquisition tool on the market, and the only truly forensically sound one delivering repeatable results after subsequent extractions. The list of supported devices will be expanded in subsequent releases.

Release notes

• Improved support for iPhone 5s, iPhone 6, iPhone 6s, iPhone SE
• Significantly improved exploit success rate, less dependencies from the computer, port, cable
• Added compatibility with all iOS 14.x versions up to 14.8.1, incl. OTA updates
• Added compatibility with iOS 15.0, 15.0.1, 15.0.2, 15.1 (iPhone 6s and iPhone SE) (file system only, no keychain for the time being)
• Improved extended logical acquisition (backups and media files)
• Acquisition agent: functionality and reliability improvements
• Keychain extraction: multiple improvements and fixes
• Improved support for jailbroken devices (all device models)
• Added support for macOS 12 Monterey
• Improved Apple Silicon support