In law enforcement use a “consent extraction” means the examiner knows the passcode. It rarely signals owner agreement. That would be a vocabulary issue if the passcode remained the whole key. Since iOS 26.4 it does not. Stolen Device Protection is on by default, and away from familiar locations it requires Face ID or Touch ID before the “Trust This Computer” prompt. The passcode still unlocks the device and confirms Trust. SDP adds a second requirement on top. An extraction that once needed one credential now needs two, and legal systems treat the two credentials as different kinds of thing.

In simple terms a write blocker sits between the original drive or device and your forensic workstation and stops any write commands from getting through, while letting you read every bit. Along with checksums, write blockers help maintaining chain of custody, ensuring that the imaging step is repeatable and verifiable. Hardware write blockers are physical devices you plug the source media into, software write blockers are installed on the acquisition system, and the former type is more robust than the latter. The point, however, is not speed or convenience, it is to make a forensic copy without changing the original, so the evidence you work from is the same as the evidence you seized. And here comes the question: which laws or standards mandate using a write blocker?

iOS 27 and iPadOS 27, currently in beta, add a bootable recovery menu to the iPhone and iPad. Hold the power button while the device starts up and you land in a small pre-boot environment with six options, one of which is the old “connect to computer” recovery mode. This is the same idea Apple silicon Macs have had for years, and it is overdue on the phone.

Elcomsoft iOS Forensic Toolkit begins low-level extraction by sideloading the extraction agent, and the agent will not run until the phone has completed one or two checks against Apple’s servers. Network requests, on a phone that is evidence. That single requirement is why we have shipped three different firewalls over the past three years. The newest one, EIFT Firewall, is a free macOS application and a direct replacement for the 2023 script.