Our customers often ask us which exact iOS versions are supported by iOS Forensic Toolkit. There’s always a temptation to answer “all of them,” and while that answer is technically correct, there are a lot of caveats. The devil is in the details, and the real answer depends on what you mean by “support”.

Not just iOS

iOS is not the only mobile operating system from Apple: it runs only on the iPhone and iPod touch. There is also iPadOS (for iPad), watchOS (for Apple Watch), tvOS (for Apple TV), audioOS (for Apple HomePod), and visionOS (for Apple Vision Pro), many of which we recently reviewed: Exploring iPadOS, tvOS and audioOS 17 and 18 Devices.

Before version 26, version numbering was “out of sync”: watchOS numbers lagged other devices’ by seven – for example, watchOS 2 corresponds roughly to iOS 9, and watchOS 11 is close to iOS 18. Version 26 finally fixed this; numbering is now common across all devices (including macOS).

In fact, some other Apple devices have their own operating software – or you might call it firmware. Examples include AirPods, the Lightning to HDMI Adapter (this one is special; for example, it is vulnerable to the checkm8 exploit and can run Doom), and even Apple power adapters and cables. These devices are out of scope for this article because they do not retain user data.

Speaking of differences between OS variants: of course there are some. iOS and iPadOS are very close and differ mostly in UI. The others share the same kernel base, but watchOS, tvOS, and audioOS (we have not yet explored visionOS) are significantly limited in features while providing extra, device-specific functionality for Watch/TV/HomePod devices.

OS updates

Every new major OS version tends to be more power-hungry and sometimes requires specific features of newer SoCs. This, however, is rarely the only deciding factor for Apple, as we’ll see below. For example, iPhone 5s and 6 (A7/A8 respectively) can run iOS up to 12.5.7; iPhone 6s and 7 (A9/A10) support iOS 15.8.5; iPhone 8 and X support iOS 16.7.2; iPhone XR and XS support iOS 18.7.1. Only newer iPhones (starting with iPhone 11) can run iOS 26.

However, the situation is different for other devices in the Apple ecosystem. For example, iPad 7 (running an A10 like the iPhone 7) supports iPadOS 18, but the iPad 6, which uses the exact same SoC, only supports iPadOS 17. iPad Pro 2 (A10X, slightly faster than the A10) supports iPadOS 17 only. And Apple TV HD (A8) even runs tvOS 26.

It is understandable that tvOS is simpler than iOS and can run on less powerful CPUs, but the differences between iOS and iPadOS are not that significant. So that might not be a technical limitation but pure marketing.

Acquisition methods

This is probably the main point. Again, there are three main acquisition methods for Apple mobile devices:

• Based on bootloader exploit (e.g. checkm8)
• Based on kernel exploits (the extraction agent)
• Advanced logical

For devices vulnerable to bootloader exploits (all those based on A10/A10X SoCs and below, as well as A11 with some limitations), all compatible OS versions up to 18 are supported. We are currently working on OS 26 support.

Agent-based extraction (for A11 and newer devices) works with iOS/iPadOS versions 12.0 through 16.6.1.

Finally, advanced logical extraction is available for all iOS, iPadOS, tvOS, watchOS, and audioOS versions from 3 to 26, but:

• Only iPhone and iPad devices support the “backup” service; for other devices, you are limited to acquiring media files and logs.
• Backups may be password-protected, and those passwords can be extremely difficult to break (though in some cases it’s possible to reset them — with serious consequences).
• Logical acquisition requires device pairing (establishing a trusted connection with a computer), which can be a problem if “Stolen Device Protection” is enabled and you cannot pass biometric authentication.
• Even if you can extract a device backup, remember that it contains far less data compared to a full file system extraction.

Conclusion

As you can see, there is no simple answer to the question about iOS (or rather, OS) version support. “It depends” is probably the best response. It’s not only about the OS version but also about the device type, model, and several other factors.